Hackers Got Into 11.7 Million Capcom Accounts, Then Changed Passwords to Lock Some Players Out of Their Own

Hackers broke into Capcom's player account system and walked away with data tied to more than 11.7 million accounts. On a few hundred of them, they went a step further and changed the passwords so the real owners could no longer log in.

The Japanese publisher behind Resident Evil, Monster Hunter, Street Fighter and Mega Man confirmed the breach of CAPCOM ID, the shared account it uses across its web services and some online games. Capcom has about 4,000 employees and roughly $1.24 billion in annual revenue.

What was taken

For more than 11.7 million accounts, the exposed data includes email addresses, account creation dates, last login timestamps, the number of logins and the IP address used at the last login. For 43 accounts, the attackers also saw date of birth, gender, nickname and country.

Then there are the 196 accounts where the intruders changed the login passwords in an attempt to lock the owners out. Capcom says it has reset them.

The company says the passwords of all other members were not exposed, credit card information was not affected and its online services kept running normally.

A fast disclosure, a quiet cause

When the attackers first got in is unclear. Capcom says it spotted suspicious activity and confirmed unauthorized access on October 19, and by the next day it was clear customer information had been compromised. On October 21 it reported the incident to police and to Japan's Personal Information Protection Commission, and it published its alert on October 22, Help Net Security reports.

Capcom says it has identified how the attackers got in and put measures in place. It has not said what that entry point was. Affected customers will be notified in stages, with support channels set up by region.

No group has claimed the attack, and no ransom demand has been reported.

Second time around

Capcom has been breached before. In November 2020, the Ragnar Locker ransomware gang claimed it had stolen 1 TB of data from the company, and Capcom warned that up to 390,000 people could be affected. In April 2021 it disclosed that the attackers had come in through an old VPN device.

This time the haul is smaller per person but far wider. An email address paired with a last login time and IP address is exactly the raw material a phisher needs to write a convincing fake Capcom security notice, and the company itself is warning users to watch for unsolicited messages that ask for more information or carry links and attachments. Players who reused their Capcom password on other services have good reason to change it there, and any email that claims to come from Capcom and asks for a click deserves suspicion for a while.

Account takeovers rarely stop at the first login. In a recent campaign against Microsoft 365, attackers used stolen sessions to skip MFA entirely, and the locked-out Capcom players are a reminder that the goal is often control, not just data.

Some offers on this page may be paid placements or contain affiliate links.