Capcom confirms breach exposing 11.7 million unified Capcom ID accounts

Capcom confirmed a third-party breach of its unified Capcom ID service, detected October 19. The attack exposed 11,774,247 account records worldwide, including emails and system identifiers. Attackers changed passwords on 196 accounts without authorization; credit card data was not affected. This is Capcom's second major breach since the November 2020 ransomware attack on its servers.

Capcom ID functions as one account across Capcom's web services and online games.
Street Fighter 6 and other titles rely on this single identifier for online play.
A breach of one shared credential system therefore touches Capcom's entire online portfolio at once.
For 43 accounts, attackers also obtained birth date, gender, country, region and nickname data.

Capcom reported the incident to Osaka Prefectural Police and Japan's Personal Information Protection Commission.
The company disclosed only a global total of 11,774,247 records, with no country breakdown.
That omission leaves the scope of impact on users in specific markets undetermined.
Regional notification duties under frameworks like GDPR depend on exactly this kind of breakdown.

Capcom ID access and gameplay remain unaffected, so Street Fighter 6 stays online as usual.
Capcom warned that exposed email addresses could be used for phishing emails impersonating the company.
Users were told not to click links or open attachments in unsolicited messages.
Keeping the compromised identity layer live while investigating raises ongoing exposure for affected accounts.

For Publishers & Developers: Segment shared account systems so one breach cannot reach every live title.
For Investors & VC: Add identity-layer security audits and per-country breach reporting to publisher diligence.
For Service Vendors: Pitch breach-response support and identity hardening to publishers running cross-title account systems.