Capcom has disclosed a data breach affecting more than 11.7 million Capcom ID accounts, the single sign-on used across its online games and web services. The publisher says customer information was accessed by an unauthorised third party on October 19.
What changed: Capcom confirmed a breach affecting over 11.7 million Capcom ID accounts, with unauthorised password changes on 196 accounts. Why it matters: Capcom ID covers Street Fighter 6, Monster Hunter and Resident Evil online services — one credential set spans the publisher’s whole portfolio. Who should care: Anyone with a Capcom ID account, particularly those reusing that password elsewhere.
What Capcom has confirmed
| Item | Detail |
|---|---|
| Accounts affected | Over 11.7 million |
| Breach date | October 19 |
| Passwords compromised | Not confirmed for customer-set login passwords |
| Unauthorised password changes | 196 accounts, since reset |
| Service status | Games and Capcom ID services remain available |
The 196 figure is the part that matters operationally. Capcom states it has not confirmed any compromise of login passwords originally set by customers, but it has confirmed that passwords were changed without authorisation on 196 accounts — and those have been reset.
How to read that carefully
“We have not confirmed” is not the same as “did not happen”. Capcom’s wording leaves open the possibility that password data was exposed in a form it has not yet finished analysing. The 196 unauthorised changes are a concrete signal that some accounts were actively manipulated, not merely listed.
The publisher says it has completed emergency response measures, identified and addressed the attack method, and will begin contacting affected customers. It has also said it is investigating the scope of any impact.
What to do now
The practical advice is standard and still correct: change your Capcom ID password if you have not since October 19, and change it anywhere else you reused the same credentials. Password reuse is what turns a publisher-side breach into a wider account problem, and 11.7 million is large enough that credential-stuffing attempts against other services are likely.
If you play Street Fighter 6 or Monster Hunter online, note that services remain available — this is not an outage, so there is no in-game signal that anything happened. The notification comes from Capcom directly.
What is still unknown
Capcom has not published a breakdown of what categories of data the third party accessed, or how the accounts were compromised. It has also not said whether two-factor authentication was in place on the affected accounts or whether it will be enforced.
Forward look
Capcom says it will contact affected customers as its investigation continues. The next concrete disclosures to watch are the data categories involved and whether the publisher tightens authentication requirements across Capcom ID — the measure that would limit the damage from a repeat.