Threat Intelligence Brief
Curated summary with source attribution
Source: securityweek.com
Threat Risk: Medium
Victim: Capcom
Incident: Unauthorized access to the CAPCOM ID shared service leading to a data breach.
Impact: Theft of 11.7 million email addresses and limited PII for a small number of users.
Attacker: Unidentified threat actors
Analysis: Attackers gained unauthorized access to the CAPCOM ID service, harvesting over 11 million email addresses and associated account metadata. While widespread password theft was avoided, the sheer volume of leaked contact information creates a high risk for large-scale social engineering. This incident underscores the inherent risk of centralized identity providers in the gaming sector.
Recommendations: Enable multi-factor authentication (MFA) across all gaming and personal email accounts; Exercise extreme caution with unsolicited emails claiming to be from Capcom or its partners; Utilize a password manager to ensure unique, complex credentials for every online service
Source: SecurityWeek
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-10-23 09:57 UTC
Unauthorized access to the CAPCOM ID account service database. Exposure of 11.7 million records containing email addresses, login timestamps, and IP addresses. An unauthorized third party accessed the CAPCOM ID system, leaking over 11 million account records. While primary passwords and payment data remained secure, the exposed email addresses and login metadata provide a goldmine for targeted phishing campaigns. The breach highlights the persistent targeting of high-profile gaming publishers.
Corroborating source: helpnetsecurity.com
Update — 2026-10-23 11:17 UTC
Unauthorized access and data exfiltration from the CAPCOM ID membership service. Exposure of personal metadata for 11.7 million accounts, elevating social engineering risks. Attackers gained unauthorized access to the CAPCOM ID membership service, exfiltrating email addresses and login metadata for millions of users. While core passwords and financial data remained secure, the scale of the leak significantly increases the risk of targeted phishing campaigns. The incident highlights the persistent risk facing large-scale consumer identity databases.
Corroborating source: rescana.com
Update — 2026-10-24 05:55 UTC
Data breach of the Capcom ID unified account system. Exposure of personal identifiable information for approximately 11.7 million users. Unauthorized access to Capcom’s unified ID system resulted in the theft of personal information for over 11 million users. While financial data remained secure, the leaked PII—including emails and birthdays—provides significant fuel for targeted phishing and identity theft. The scale of this incident underscores the systemic risk posed by centralized account services.
Corroborating source: nintendojo.com