Capcom confirmed on Thursday that 11.77 million CAPCOM ID email addresses leaked, then did the thing companies rarely do: it warned its own customers that phishing emails impersonating Capcom are coming. I run AliasFleet, an email-alias service that gives you one forwarding address per site, so any leak names its source. The login metadata in this leak makes the forgeries believable, because the attacker can quote your own account history back at you. An alias per gaming account turns that around: every fake Capcom email identifies itself, and killing the alias kills the channel.
11.77 million records, confirmed by Capcom itself
The disclosure landed on 22 October in Capcom's own IR notice (also published in English). Reuters JP and 4Gamer restated the company figures the same day. CAPCOM ID is the unified account needed to use Capcom's web services and play some of its games online, and an unauthorised third party got into it.
The numbers, as Capcom states them:
- 11,774,247 records, worldwide total: email addresses plus system identifiers. A confirmed leak, not an estimate.
- 43 records inside that total: date of birth, gender, country or region, nickname.
- 196 accounts: login passwords changed without authorisation. Capcom says it has not confirmed any leak of the passwords customers set themselves, and the 196 accounts have already been reset.
No credit card information was in the leaked data. Services using CAPCOM ID keep working, and Capcom says gameplay is unaffected.
The timeline moved fast. Suspicious access traces were found on 19 October, the access was blocked, and the intrusion was confirmed the same day. On 20 October Capcom stood up an internal response headquarters, confirmed the leak, and confirmed the unauthorised password changes. On 21 October it reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. On 22 October it went public.
The 196 changed passwords
Passwords do not change themselves. Somebody changed 196 of them, which means somebody was in a position to do it, whether inside those accounts or through a reset flow. Capcom reset all 196 and says the scope of impact is still under investigation. If you hold a CAPCOM ID, treat your password as compromised regardless of whether yours was one of the 196.
What is confirmed and what is not
Capcom's notice is precise in some places and quiet in others. This is the split as it stands:
| Confirmed | Not yet confirmed |
|---|---|
| The leak itself: Capcom announced it on 22 October, 11,774,247 records worldwide | The attack method. Capcom says it identified and addressed it, but disclosed no technical detail |
| The identifiers beside each email: account creation date and time, last-login date and time, login count, client IP at last login | Whether the dataset is circulating, being sold, or has been used for anything beyond the 196 password changes |
| The 43-record subset: date of birth, gender, country or region, nickname | Whether the 11.77 million count grows as the investigation continues |
| The 196 accounts: passwords changed without authorisation, all reset; user-set passwords not confirmed leaked | What the attacker did inside the 196 accounts |
| No credit card data; services keep running; affected customers to be notified individually | Whether those individual notifications have started arriving |
The login metadata is the dangerous part
The email addresses are the headline. The identifiers are the weapon. Every leaked record pairs an email with the account creation date and time, the last-login date and time, the login count, and the client IP used at last login.
Picture the email that lands next week. "Suspicious sign-in detected on your CAPCOM ID. Your account was created on 14 March 2022, last accessed yesterday at 21:47 from IP 203.0.113.44. Total sign-ins: 312." You check the creation date. It matches. You check the last login. It matches. The guard drops, because nobody fakes details that specific. Except the attacker is not faking them. They are reading them out of the file Capcom lost.
That is the whole trick of this breach. Real details do not prove the sender is Capcom. They prove the sender has the file. Anyone reading your own account history back to you is demonstrating possession of stolen data, not membership of a security team. And for 43 people it gets worse: date of birth, gender, country or region, nickname, which is enough to personalise the lure and start working through account-recovery questions on other services.
Capcom is warning you about the forgeries itself
Breach notices usually end with a vague line about staying vigilant. Capcom went further and put the warning in the body of its own notice: the leaked information could be misused to send fraudulent messages impersonating Capcom or related parties, and customers should not access URLs or open attachments in suspicious mail. That is the company telling you, in writing, that the follow-on attack is not hypothetical. It is expected.
Capcom says customers may receive fraudulent messages impersonating the company or its partners, and asks recipients not to access the URLs or open the attachments in any suspicious mail. Capcom will notify affected customers individually, so forged copies of that notification are the most likely next move. No link in any email about this breach is worth clicking, including the real one. Open Capcom's own site yourself.
This is the part people get wrong. Capcom's individual notification will be real, and the forgery quoting the same incident will arrive beside it, linking to a page that looks the same. Content cannot tell them apart, because the attacker has the real context. The verdict comes from where you land, not what you read: Capcom's own site or support pages, reached by typing the address yourself.
One address per game account
Gaming accounts are the registrations nobody protects. You make the account for one game, type in the email you use for everything, and forget the account exists. That address then sits in a database for years, gets pulled into a breach, and becomes the delivery route for every scam that follows.
The fix is dull and it works: a unique email alias for each gaming service, forwarding to your real inbox. Every message on the Capcom alias comes from exactly one of two senders: Capcom, or the people holding the leaked file. There is nothing else it can be. A "CAPCOM ID security alert" on the address you gave only to Capcom, asking you to confirm your details, has identified itself as the forgery. Capcom already has that alias on file. It would never need you to hand it back. Shut down the Capcom-only alias and the forgeries aimed at that account have nowhere left to land, while your real inbox never sees a word.
This is also how the leak names its source. A message arrives on an address you used at exactly one service, and you know which company it escaped from. The leak-tracing mechanism works exactly this way.
Lock down your CAPCOM ID before the forgeries land
- Change your CAPCOM ID password now, and make it unique to Capcom. The 196 changed accounts are the confirmed floor, not the ceiling.
- Turn on two-factor authentication on the email account behind your CAPCOM ID. Your leaked address plus leaked login history are the exact raw material of account-recovery attacks, and a second factor is one barrier a scripted caller cannot talk a support agent past.
- Do not click any link in any email about this breach. Open Capcom's site yourself. This applies to the genuine notification too.
- Expect messages that quote your real details. Your creation date, your last login, your IP address: anyone reading them back to you is proving they have the file, not that they are Capcom.
- Do not reuse the password you used at Capcom anywhere else. If it matches another service, change it there now, because credential stuffing pairs your leaked email with passwords from other breaches.
- Search Have I Been Pwned once the incident is added, then work through the breach-response order of operations. It covers exactly this scenario.
Six years after the ransomware
This is Capcom's second major breach in six years. In November 2020 the company was hit by a customised ransomware attack. Its own third update, in January 2021, verified the personal data of 16,415 people as compromised and put the potential maximum at around 390,000 customers, business partners and others, with names, addresses, emails and dates of birth among the data at risk (Capcom's update). Polygon's reporting at the time covered what was leaked, including corporate secrets and source code. But the terabyte figure itself was the attackers' own claim: their ransom note stated roughly a terabyte of data had been exfiltrated, as BleepingComputer reported at the time.
That attack hit Capcom's corporate network, not CAPCOM ID, so these are two different intrusions, not one long one. Honestly, the repeat is what stings: Capcom says it has identified and addressed the attack method this time, but has disclosed nothing about it. The data you hand a company stays in the blast radius of its next incident, not just this one.
What the investigation still owes everyone
Capcom's notice closes with a promise to update its official site as new facts emerge, and the facts that matter are the ones it has not shared. Nobody outside the company knows how the attacker got in, which means every other company holding the same kind of account data cannot learn from it. Nobody knows whether the 11.77 million records are circulating or sitting quiet, and Capcom has confirmed nothing beyond the 196 password changes. And the impersonation wave Capcom itself warned about has not landed yet. It is coming. Treat every Capcom email as a forgery audition until you have verified it through a channel you typed yourself.
Top comments (0)