Capcom’s 11.7 Million-Account Breach Didn’t Leak Passwords. It Leaked Something Phishers Love More

When a company says "no passwords were confirmed stolen," most people stop reading. With the Capcom breach, that would be a mistake. The data that did leak is exactly what a scammer needs to write a fake security alert you'd actually believe.

Capcom, the publisher behind Resident Evil, Monster Hunter and Street Fighter, says an outside party got into its CAPCOM ID account system and exposed 11,774,247 email address records worldwide. Capcom detected the suspicious activity on October 19, started blocking it the same day, and published its notice on October 22. If you have ever made a CAPCOM ID to play online or link a console account, this is worth five minutes of your time.

What leaked, and why it's more useful than it sounds

For every one of those 11.77 million records, Capcom lists the email address, the account creation date and time, the last login date and time, the number of logins, and the IP address used at the last login. For 43 records, date of birth, gender, country or region and nickname were exposed too.

None of that is a password. But think about how a phishing email works. The hardest part for a scammer is sounding real. Now picture a message that says, "We noticed a sign-in to your CAPCOM ID from a new location. Your last login was on this date from this address." Every detail in it could be true. That's the danger here, and it's why Capcom itself warns that the stolen data could be used in fake emails, texts or phone calls pretending to be from Capcom or related parties.

I wrote a step-by-step guide to checking and securing your CAPCOM ID that walks through each part of the account settings, so I won't repeat all of it here.

The 196 accounts that tell the real story

The headline number is 11.77 million, but the more telling one is 196. That's how many accounts had their passwords changed without permission. Capcom has reset them. In a follow-up notice on Friday, October 23, Capcom added that 19 of those accounts were also used to open e-Capcom store pages in Japan, exposing names, phone numbers, addresses, dates of birth and purchase history for those customers.

So the intruders didn't just copy a list. For a small number of accounts, they actually got in and looked around. Capcom says it has identified and addressed the attack method and that its investigation into the scope is complete, but it hasn't said how the attackers got in or who they are.

What I'd do today if I had a CAPCOM ID

First, treat every "Capcom" message with suspicion, and type the address into your browser yourself instead of clicking. Second, sign in. Your login ID is your registered email, and if your password suddenly doesn't work, that could mean yours was one of the 196. Third, turn on two-factor authentication from your Account page. Capcom supports authenticator apps like Google Authenticator and Microsoft Authenticator.

There's one detail most people will miss: check which PlayStation, Xbox, Steam, Epic or Nintendo accounts are linked to your CAPCOM ID, and unlink anything you don't recognize. Capcom hasn't reported any impact on linked accounts, but it takes a minute to look.

The good news is real, too. Capcom says credit card information wasn't included, your games still work, and you can keep using the same email address.

A pattern worth noticing

This has been a busy month for account breaches. Developers just went through a similar scramble after the OpenCode breach exposed saved AI provider keys. The lesson keeps repeating: the leak itself is often less dangerous than the convincing follow-up scams it makes possible.

The full checklist, the who-is-affected table, Capcom's regional support contacts and answers to the most common questions are all in one place. I break down the full details on The Frontier Brief.