Capcom has confirmed a data breach affecting more than 11.7 million users of its Capcom ID service. The company said the incident involved “unauthorized access by a third party,” but Capcom ID remains available for users, including players who need the service for online games such as Street Fighter 6.
The breach did not include customer credit card information, but it did expose millions of account email addresses. Capcom also said the incident involved unauthorized changes to 196 account passwords, while no existing passwords were leaked.
That combination leaves users with a clear warning: watch for messages that appear to come from Capcom. The exposed information could be used to send phishing emails that impersonate the company and try to trick users into sharing more personal details.
What Capcom Found
Capcom said it detected suspicious activity on October 19, describing it as “suspicious activity indicating potential unauthorized access” to Capcom ID. The company blocked access immediately and began investigating the cause and scope of the incident.
Capcom has confirmed that the unauthorized access already happened. It also said it “identified and addressed the attack method in this incident,” which means the company has taken action against the method used in the breach. Capcom reported the incident to local police and its external advisory board for security oversight.
The exposed information was not the same for every account. Along with the millions of account emails, data from 43 accounts included birth dates, gender, country or region, and nicknames. Those details can make scam messages look more personal, especially when combined with an account email.
Capcom ID services remain available despite the breach. Players can still use services that depend on the membership system, including online play in Street Fighter 6. The company has warned users to be wary of suspicious emails because the leaked information could support messages designed to look like official Capcom communication.
A Wider Run of Data Breach Warnings
The Capcom incident comes as more companies in Japan report cyberattacks that put millions of people at risk of identity theft. In early October, unauthorized access and possible user-data leaks were reported by Daiwa Securities, GMO Research, Rakuten Drive, the Nikkei media group, and Yakiniku King.
Rockstar Games also confirmed in April that it had suffered a “third-party data breach.” These incidents show how attacks can affect companies across gaming, finance, media, retail, and other services, even when the exposed information differs from one case to another.
Another breach involved the Digital Agency through a vendor responsible for overseeing parts of its website. The agency said more than 13,000 user profiles may have been affected. The profiles contained names and email addresses, while some accounts may also have included telephone numbers and delivery addresses.
The affected website belonged to Studio Co. Digital minister Toshiharu Furukawa confirmed the unauthorized access at a news conference on Friday. The website held data originally collected by the Digital Agency between 2021 and 2023.
Studio Co. said a third party had “illegally accessed its cloud environment and enabled data in the environment to be acquired from external sources.” The breach took place between Sept. 30 and Oct. 1, and the company confirmed it on Oct. 13. Studio Co. reported the unauthorized access on Oct. 16, when the Digital Agency was also informed.
The Digital Agency said its own investigation process caused the delay in acknowledging the breach. In a statement on Thursday, the agency said, “At this time, we have not confirmed any secondary damage, such as the misuse of leaked personal data. However, please be careful of suspicious e-mails, phone calls and texts pretending to be from Digital Agency or related organizations,”
The Digital Agency has faced another data breach involving its own information. Unauthorized access revealed on Sept. 11 affected the Government Solution Service and led to the leaking of names and email addresses belonging to government employees.
For Capcom ID users, the immediate concern is not credit card theft or the release of existing passwords. It is the use of exposed email addresses and account details in convincing scam messages. Users should treat unexpected messages claiming to be from Capcom with caution, especially when they ask for account information or other personal details.
Based on
- Capcom confirms data breach that affected 11.7 million users — engadget.com
- Capcom data breach leaks over 11 million email addresses. | The Verge — theverge.com
- Cyberattacks continue; millions at risk of identity theft | National News | The JapanTimes Alpha Online — alpha.japantimes.co.jp
- Digital Agency reports data breach via website vendor – The Japan Times — japantimes.co.jp
