Capcom has confirmed a major cybersecurity incident affecting its CAPCOM ID membership platform, with information linked to more than 11.7 million accounts exposed following unauthorized access by a third party. According to the company, the compromised data includes email addresses as well as technical account information such as login timestamps and account creation records. Capcom also identified unauthorized password changes affecting 196 accounts and 43 cases where personal profile information, including date of birth, gender, country and nickname, was accessed without permission.

The publisher says there is currently no evidence that passwords originally created by users were compromised during the attack. Passwords associated with the affected accounts have already been reset as a precaution. Capcom also stressed that payment information was not involved in the breach, meaning no credit card data was exposed through the CAPCOM ID incident. Dedicated customer support channels have been opened, while users identified as potentially affected are expected to receive direct notifications from the company.

Capcom first detected suspicious activity on October 19 and immediately began restricting access while launching an investigation. After confirming unauthorized entry into the service, the company activated emergency security measures and created an internal response headquarters the following day. The incident and the categories of exposed information were subsequently reported to Capcom's external Information Technology Security Oversight Committee. On October 21, the company also notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission as the investigation continued.

The breach represents a significant security challenge for one of the gaming industry's most recognizable publishers. Capcom is responsible for major franchises including Resident Evil, Monster Hunter, Street Fighter, Mega Man and Ace Attorney, giving its online services a massive global audience. The company says it intends to reinforce its cybersecurity infrastructure and introduce additional preventive measures designed to reduce the risk of similar incidents in the future.