Capcom says breach exposed data of over 11.7 million users

Capcom, the Japanese video‑game developer best known for titles such as Resident Evil and Street Fighter, announced on Tuesday that its online membership platform, CAPCOM ID, suffered a cyber‑attack that compromised the personal information of more than 11.7 million registered users.

The intrusion, which the company says was carried out by an external hacker group, gave the perpetrators access to email addresses and other details linked to the affected accounts. Capcom disclosed the breach after internal security monitors flagged unusual activity on the service, prompting a forensic investigation that confirmed the scale of the exposure.

In response, Capcom has engaged a third‑party cybersecurity firm to conduct a full assessment, is resetting passwords for all compromised accounts, and has begun notifying users via email with instructions on how to secure their profiles. The firm also pledged to enhance its authentication mechanisms and to review its data‑storage practices to prevent similar incidents.

The leak arrives at a time when the gaming sector is grappling with a series of high‑profile data breaches, raising concerns that personal data harvested from gaming platforms could be repurposed for phishing scams or credential‑stuffing attacks. Analysts note that the sheer number of records involved makes the incident one of the largest in the industry to date.

Under Japan’s Act on the Protection of Personal Information, companies are required to report significant data‑security incidents to regulators and to affected individuals. Failure to comply can result in administrative penalties and damage to brand reputation. Capcom’s swift public acknowledgment is intended to meet those legal obligations and to preserve consumer confidence.

Looking ahead, the company says it will continue to monitor for any signs of misuse of the exposed data and will work with law‑enforcement agencies to identify the attackers. Users are advised to watch for unsolicited communications, enable two‑factor authentication where possible, and avoid reusing passwords across different services.