Capcom ID Breach: How to Check Your Account and What to Do Now

CAPCOM ID breach key facts: 11,774,247 email records exposed, 196 passwords changed and reset, 19 e-Capcom store accounts in Japan viewed, no card data, turn on two-factor authentication

Capcom says an outside party broke into its CAPCOM ID account system, exposing 11,774,247 email address records worldwide plus login details such as each account's last login IP address. If you have a CAPCOM ID for Resident Evil, Monster Hunter or Street Fighter, Capcom hasn't confirmed any stolen passwords, but you should expect convincing phishing emails. The 7 steps below show how to check your account, turn on two-factor authentication and lock it down.

The short answer: your games still work, and Capcom says passwords customers set themselves were not confirmed compromised and credit card information was not included. Attackers did change the passwords on 196 accounts, and in a follow-up notice dated Friday, October 23, Capcom says 19 of those accounts also had personal details from its Japanese online store viewed.

What happened

In a notice dated Thursday, October 22, the Japanese publisher says it detected suspicious activity on CAPCOM ID on October 19, began blocking the access the same day and confirmed that a third party had got in. CAPCOM ID is Capcom's free shared account for its web services and some online games.

For 11,774,247 records, the exposed data is the email address plus account creation date and time, last login date and time, number of logins and the client IP address used at the last login. For 43 of those records, date of birth, gender, country or region and nickname were also exposed. Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21.

Capcom says it has identified and addressed the attack method, but it has not said how the attackers got in or who they are, as BleepingComputer notes. Games and services that use CAPCOM ID remain available, and Capcom says you can keep using the email address you registered.

New on Friday: 19 store accounts exposed

Capcom's October 23 update says the attackers who changed 196 account passwords used 19 of those accounts to open e-Capcom account pages. e-Capcom is Capcom's online store in Japan. For those 19 Japanese customers, the exposed details include name, phone number, postal code, address, gender, date of birth, purchase history, customer inquiry history and saved address book information. Capcom says it found no compromised information for the other password-changed accounts and that its investigation into the scope of the incident is now complete.

Who is affected: the breach at a glance

Group	Records	What was exposed or changed
All affected CAPCOM IDs	11,774,247	Email, account creation time, last login time, login count, last-login IP address
Extra profile data	43	Date of birth, gender, country or region, nickname
Passwords changed by attackers	196	Login password changed without permission; Capcom has reset them
e-Capcom store pages opened (Japan)	19	Name, phone, address, date of birth, purchase history, address book
Credit cards	None	Capcom says card information was not included

How to check and secure your CAPCOM ID: 7 steps

These steps follow Capcom's two notices and its CAPCOM ID support FAQ. Where a step is our advice, we say so.

Don't click links in "Capcom" messages. Capcom warns the stolen data could be used in fake emails, texts or phone calls impersonating it or related parties, and asks you not to open links or attachments in them. Our advice: type the CAPCOM ID address into your browser yourself.
Sign in to check your account. Your login ID is the email you registered with. If your password no longer works, select "Forgot your password?" on the log-in page to reset it. Our advice: a password that suddenly fails could mean yours was one of the 196 that attackers changed.
Set a new, unique password. Our advice, though Capcom hasn't confirmed any password leak: pick one you use nowhere else, ideally from a password manager.
Turn on two-factor authentication. Set it up from your Account page. You need a phone or tablet and an authenticator app; Capcom recommends Google Authenticator or Microsoft Authenticator. If you change phones later, cancel two-factor on the old device first, or you won't be able to log in on the new one.
Review your linked platform accounts. Open "Platform Account Information" on your Account page to see which PlayStation, Xbox network, Steam, Epic Games or Nintendo accounts are linked, and unlink any you don't recognize.
Change reused passwords elsewhere. Our advice: with 11.77 million email addresses now out, anyone who used their CAPCOM ID password on another site should change it there too, starting with email and gaming accounts.
Contact Capcom if something looks wrong. Capcom has set up incident support: the Capcom support inquiry form for the Americas and for Europe, the Middle East and Africa (or feedback@capcom.com), info-asia@capcom.com for Asia outside Japan and Oceania, and a toll-free line, 0120-801-271, in Japan.

What this means for you

Most CAPCOM ID users: Your email and login history may be exposed. Watch for phishing, turn on two-factor and move on; Capcom says your games aren't affected.
If you can't log in: Reset your password, then use the support channel for your region.
e-Capcom shoppers in Japan: Capcom says it will notify affected customers; 19 had their name, address and purchase history viewed.

Why it matters

Phishing is the real risk: An email address tied to a real gaming account and its last login time is enough for a believable fake "security alert." The same applies after most leaks, as in our guide to what to do after Meta Muse share links were exposed.
Accounts are the target: This week also saw developer secrets taken in attacks like the one in our OpenCode breach key-rotation guide, and server owners racing to patch, as in our PHP2Shell patch check.
Not Capcom's first breach: BleepingComputer recalls that Capcom was hit by a ransomware attack claimed by the Ragnar Locker gang in November 2020.

Quick answers

Is there a site to check if my CAPCOM ID was in the breach?

Capcom's notices don't mention a lookup tool. It says it will contact affected customers directly.

Do I need to change my CAPCOM ID email address?

No. Capcom says registered email addresses can keep being used without interruption.

Were my games or linked console accounts hit?

Capcom says its games are not affected. It has not reported any impact on linked PlayStation, Xbox, Steam, Epic or Nintendo accounts.

What's next

Capcom says it will notify affected customers, keep monitoring CAPCOM ID and related services, and put measures in place to prevent a repeat. IGN and The Verge both stress that no existing passwords were exposed, so fake Capcom messages are the main thing to watch for.

FAQ

Was my CAPCOM ID password stolen in the breach?

Capcom says it has not confirmed any compromise of passwords customers set themselves. Attackers did change the passwords on 196 accounts, and Capcom has reset those.

How do I know if my CAPCOM ID was affected?

Capcom says it will notify affected customers. About 11.77 million email records were involved, so if you have a CAPCOM ID, assume your email and login details may be exposed.

Was credit card information exposed in the Capcom breach?

No. Capcom says credit card information was not included in either its October 22 notice or its October 23 update.

Does the Capcom breach affect my games?

Capcom says services that use CAPCOM ID, including games, remain available and the incident does not affect players' ability to access or play its games.

Search This Blog

The Frontier Brief