Capcom Confirms Data Breach Impacted Over 11 Million Resident Evil Maker’s Capcom ID Accounts, Warns of Phishing Emails

“Credit card information was not included among the affected information,” say the publishers

Capcom, the publisher behind Resident Evil, Street Fighter, and Monster Hunter, has revealed that a data breach allowed a third party to access information linked to more than 11 million Capcom ID accounts. According to Capcom, “suspicious activity” around the service—which is required to play online in titles such as Street Fighter 6—was first noticed on October 19th, with the company spending the past couple of days taking measures to contain and combat the problem.

In a press release, Capcom outlined that a total of 11,774,247 accounts had their email addresses and “system-specific identifier information” accessed in the breach. Of those, 43 accounts also had their date of birth, gender, country/region, and nickname records accessed.

“Capcom has not confirmed any compromise of Capcom ID account login passwords originally set by customers themselves,” the company wrote. “However, the company has confirmed that passwords were changed without authorisation on 196 accounts. The passwords associated with these accounts have already been reset, and the company continues to investigate the scope of any impact resulting from this incident. Going forward, Capcom will notify customers affected by this incident. Credit card information was not included among the affected information.

As for other advice to those affected, Capcom issued the following warning regarding the possibility of phishing attacks directed at the email addresses exposed in the breach:

“Email addresses registered with Capcom ID may continue to be used without interruption. However, there is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties. If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.”

Having reported the breach to Osaka’s Prefectural Police and Japan’s Personal Information Protection Commission as part of their initial response—which they say “identified and addressed the attack method involved in this incident”—Capcom will now proceed with a “detailed investigation” designed to flag measures that might prevent this sort of thing from happening again in the future.