Capcom confirms unauthorized access to 11.7 million CAPCOM ID accounts. Here's what to do

Capcom says a third party broke into the systems behind CAPCOM ID, the free account it uses for online play and in-game bonuses in games like Street Fighter 6 and Monster Hunter Wilds. In an October 22 notice, the company said the intruder reached the email addresses of 11,774,247 accounts worldwide, along with basic usage data for each one. Capcom says no credit card information was involved and that it has not confirmed any compromise of the passwords users set themselves.

If you have a CAPCOM ID, assume your email address is among those exposed. Capcom warns the data could be used to send fraudulent emails in its name, so your inbox is where the immediate risk lies. It's also worth changing your password and turning on two-factor authentication.

What was exposed

For all 11.7 million accounts, the intruder could see the registered email, the account creation date, the last login date, the number of logins and the IP address used for the most recent login. An IP address identifies an internet connection and can reveal a rough location and the internet provider behind it. For 43 accounts, the data also included date of birth, gender, country or region, and nickname.

The more serious problem involves 196 accounts whose passwords someone changed without permission. Capcom has reset them and is still working out what else may have happened to those accounts. The company says it has identified and dealt with the attack method, but it has not said what that method was or how the passwords were changed.

How to tell if you're affected

There's no lookup tool yet. Capcom says it will contact affected customers but hasn't said how or when. A message from Capcom is exactly what a scammer holding the email list would fake, so if one arrives, ignore its links and sign in by typing cid.capcom.com into your browser yourself.

If your usual password suddenly stops working, your account may be one of the 196 that Capcom reset. Contact support through Capcom's customer support form, which the company lists for the Americas and for Europe. Players in Asia outside Japan and in Oceania can write to info-asia@capcom.com.

What to do now

Capcom isn't asking anyone to change their password, and it says registered email addresses can still be used as normal. These steps still lower your risk:

1. Treat any message about your CAPCOM ID, prizes or account problems with suspicion. Capcom advises against opening links or attachments in suspicious messages. 2. Change your CAPCOM ID password at cid.capcom.com. If you used the same password anywhere else, change it there too. 3. Turn on two-factor authentication. CAPCOM ID then asks for a check from one of your devices on top of your password, and gives you recovery codes for signing in when that device isn't to hand. Keep those codes somewhere other than that device. 4. Don't unlink PlayStation Network, Xbox, Steam or Epic Games as a precaution. The notice doesn't mention those accounts, and Capcom's own guide warns that relinking may be restricted or impossible.

Those platforms use their own passwords, which Capcom doesn't list among the affected data. If you want to check them anyway, our guide to protecting and recovering Steam, PSN and Xbox accounts covers two-factor setup on each one.

Which games use CAPCOM ID

Capcom hasn't published a full list. Its notice says only that the account is needed to play some of its games online, and its sign-up guide uses Street Fighter 6 as the example. Nintendo Life describes it as the account that handles online play, cross-play and bonuses. In Monster Hunter Wilds, which gets its Ascendance expansion in 2027, linking a CAPCOM ID unlocks free items, according to Gamesplanet.

CAPCOM ID and the games that rely on it are still online. You don't need to stop playing or make a new account.

The timeline so far

Capcom spotted signs of unauthorized access on October 19 and shut it down. On October 20 it set up an incident response team and briefed an outside IT security committee. On October 21 it reported the breach to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. The figures here are Capcom's as of October 22, and the company says it will post any further facts it needs to disclose on its website.

Capcom was also hit in 2020, when a ransomware attack attributed to the Ragnar Locker group reached data on up to about 390,000 people, including customers and business partners, VGC reported.