Capcom-databrudd: 11,7 millioner CAPCOM-ID-oppføringer avslørt

Capcom confirmed on 22 October 2026 that a third party gained unauthorised access to CAPCOM ID, the account service behind online play in Street Fighter 6 and Monster Hunter, and that 11,774,247 records were exposed. President and COO Haruhiro Tsujimoto signed the apology, and the company says the account system and every game attached to it stayed online through the incident.

CAPCOM ID is the publisher’s unified login for its web services and a requirement for online play in several of its games, so an account exists for most people who have gone online in a Capcom title in recent years. The press release splits the damage into three tiers. All 11,774,247 records held an email address and what Capcom calls system-specific identifier information. Of those, 43 also carried a date of birth, gender, country or region and a nickname. Passwords were changed without authorisation on 196 accounts, and Capcom has already reset them while it works out how far the access went.

The identifier data is more specific than the phrasing suggests: the time an account was created, the time of its last login, the total number of logins and the client IP address used at that last sign-in. The notice, spotted by RockPaperShotgun, says the company has not confirmed any compromise of passwords that customers set themselves.

On payment data the notice leaves no room:

“Credit card information was not included among the affected information.”

— Capcom

The timeline runs short. Capcom picked up suspicious activity on 19 October, started blocking the access the same day and confirmed the intrusion before the day was out. An internal response headquarters went up on 20 October, when the company verified that registered customer data had been reached and briefed its external Information Technology Security Oversight Committee. On 21 October it notified the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Three days from detection to a public notice with hard numbers in it is quicker than most publishers manage, and I will take that over a statement about an investigation being ongoing.

This is also the second disclosure of its kind from the company. A Ragnar Locker ransomware attack in November 2020 ended with about 390,000 people listed as potentially affected, 16,415 of them confirmed, and that one took months of follow-up reports to size. It hit internal systems and partner records rather than an account service, which makes this the first time the publisher’s own player base has been the target.

The practical risk now sits in the inbox. Capcom warns that the exposed addresses could be used for mail impersonating the publisher or its partners, and tells customers not to open attachments or follow links in anything that looks off. A dedicated support line runs in Japan on 0120-801-271 from 10:00 to 20:00 JST, the Americas and EMEA are pointed at an inquiry form on capcom-support.com, and Asia and Oceania get routed to [email protected].

Capcom says it has identified and addressed the attack method used here, that affected customers will be contacted directly and that anything further will go up on its site. Registered addresses keep working as normal in the meantime. Opting out is not available to anyone who plays these games online, which is what makes the phishing warning worth more than the usual boilerplate.

Eleven million gaming addresses with login timestamps attached make a working phishing kit, and fake password reset mails dressed up as CAPCOM ID notices will not be far behind. The 196 unauthorised password changes are the part I would watch, because changing a password takes more access than reading a table of email addresses.

CAPCOM ID holds that many accounts because nearly everything the publisher ships now runs through it. Resident Evil 2 sold 20 million copies and became the franchise’s best seller, ahead of Resident Evil 5 at 19 million and Resident Evil 7 at 18.4 million. Analyst Rhys Elliott at Alinea Analytics put Capcom’s Steam revenue at $617 million with $309 million of that as net profit, with Requiem alone clearing $200 million on the platform.

The pace has not dropped this year either. Onimusha: Way of the Sword sold 1 million copies on launch day on 4 September and carried the series past 10 million total, Resident Evil Requiem became the fastest-selling game the franchise has had at 8.5 million, and the new IP Pragmata reached 2.5 million over the summer.

Requiem looked very different in its early drafts. Producer Masachika Kawata has described the initial plans for Resident Evil Requiem as an online concept that director Koshi Nakanishi explored and the team then dropped, with Leon as the sole protagonist until Grace Ashcroft was added because his combat skills made the horror harder to land.

Executive producer Jun Takeuchi has laid out the series as two tracks, numbered entries carrying the current story and remakes covering the past, with a plan already drawn for the point where the two meet. That framing has fans treating Resident Evil 5 and Resident Evil 6 remakes as a question of when, though insider Dusk Golem maintains neither is in active development at the moment.

The next confirmed release is Resident Evil Veronica, the remake of the 2000 Code Veronica announced at Summer Game Fest in June. A promotional video cut for the Halloween sale has fans reading a Hound Wolf Squad shirt and a repeated voice line from the original trailer as a tease of Chris Redfield in Resident Evil Veronica, alongside Claire. The remake is dated to 2027, with reports pointing at the second half of the year, and the Requiem story DLC has no date at all.