Resident Evil maker Capcom warns of phishing after 11.7 million records exposed

Gamers are being warned to watch their inboxes after someone gained unauthorized access to Capcom's online membership service. The Japanese video game developer and publisher behind Resident Evil, Monster Hunter, and Street Fighter disclosed the breach affecting more than 11.7 million CAPCOM ID records worldwide.

The exposed information includes email addresses, account activity details, and IP addresses. A much smaller number of records also contained personal details such as dates of birth. The company confirmed that credit card information was not affected.

Capcom discovered the incident on October 19 and says it has addressed the attack method. Games and services remain available, and the company plans to notify affected customers. The 11.7 million figure refers to affected records, so it may not represent that many individual users.

Unauthorized Password Changes

While Capcom has not confirmed that passwords originally chosen by customers were compromised, someone changed the passwords on 196 accounts without authorization. The company has since reset those passwords and is still investigating the impact, including how the unauthorized changes occurred and whether any other unauthorized activity took place on those accounts.

Phishing Risk

For players, the exposed information could help scammers make fake Capcom messages more convincing, potentially tricking them into handing over passwords or verification codes. CAPCOM ID is the company's unified account system for its websites and services, including online features in certain games, and can be linked to gaming platform accounts including PlayStation, Xbox, Steam, Epic Games, and Nintendo.

Safety Measures

Capcom recommends users enable CAPCOM ID's two-factor authentication, which adds an authenticator-app code to the sign-in process, helping protect accounts if passwords are obtained. Users should also check their accounts, especially if they received an unexpected password-change notice, and review registered information and linked platform accounts.

The company advises using official support channels if help is needed, finding appropriate regional contact details in Capcom's breach notice rather than trusting contact information in unexpected messages. Capcom is continuing to investigate the breach and its full impact on affected users.