Capcom — the company behind Resident Evil, Monster Hunter and Street Fighter — says someone got into the account system behind its games. If you have ever made a Capcom ID, your email address is now one of 11.7 million in a stranger’s hands.
What actually happened
On 22 October, Capcom published a notice saying a third party had broken into CAPCOM ID. That is the free account you create to play some Capcom games online, and to use the company’s websites.
The figure in the notice is 11,774,247 accounts worldwide. What leaked is your email address, plus what Capcom calls login records: when the account was created, when you last signed in, how many times you have signed in, and the IP address you used. An IP address is the number your internet connection is given, and it roughly says which city you were sitting in.
Two smaller groups are worth knowing about. For 43 accounts, the date of birth, gender, country and nickname were exposed as well. For 196 accounts, someone changed the password without permission — Capcom has already reset those.
Capcom says credit card information was not affected, and that it has found no sign that the passwords customers chose themselves were taken. It also says the games still work and CAPCOM ID accounts still work.
Why this reaches you, even if you never played
An email address looks harmless. On its own it is. What matters is what it lets someone write.
A stranger who knows your address can send you a message saying “we noticed a sign-in from a new device on 14 October”. The date is real. The city may be one you visit. The message sounds like it came from a company that actually knows you, and that is the whole trick.
The second reason is plainer. Email is the key to most of what you own online. Nearly every website will let anyone who can read your inbox set a new password — your shopping accounts, your social accounts, sometimes your bank.
So the risk is not a stranger playing your games. The risk is a message you believe on a day you are tired and in a hurry.
What you can actually do
None of this needs an app, a shop or a technician. It happens in a browser or in your phone’s settings.
- Treat every Capcom email as suspicious for the next few weeks. Do not click a link in it. Open your browser and type cid.capcom.com yourself.
- Find out whether you even have an account. On that same page choose “forgot password” and enter your email. If an account exists you get a message; if not, you are finished.
- If you do have one, sign in and set a password you have never used anywhere else. On an iPhone, Settings → Passwords can create and remember one. On Android, open Chrome, tap the three dots, then Settings → Google Password Manager.
- Turn on two-factor authentication in your CAPCOM ID settings. With it on, a password alone is not enough to get in, and Capcom gives you a recovery code to keep somewhere safe.
- If that password is also on your email, your bank or your main shopping account, change those first. They are worth more than the game.
- If you stopped playing years ago, close the account. CAPCOM ID lets you cancel it, and an account that no longer exists cannot leak again.
Common misunderstandings
Myth: my password was stolen
Capcom says it has not confirmed that any password a customer chose was taken. What happened on those 196 accounts is different: the password was replaced and the owner was locked out until Capcom reset it. If you used that same password elsewhere, changing it is still the right move.
Myth: if my card was not in it, there is nothing to worry about
A card number is easy to cancel and easy to refund. An email address with your login habits attached is not. It cannot be cancelled, and it makes every future fake message about you more convincing.
Myth: this only affects people who play games
Most people who own a CAPCOM ID made it once, years ago, for a demo, a beta test or a single online mode, and then forgot it. The account is still there. The email address inside it is still yours.
What to watch for next
Capcom says it will contact affected customers one by one, and that it has opened a dedicated inquiry line in Japan (0120-801-271, 10:00 to 20:00 local time). On 21 October it reported the incident to Osaka police and to Japan’s Personal Information Protection Commission.
Expect fake versions of that message to arrive quickly. A genuine notice will not ask you to confirm a password by email, will not send you to a login page through a link, and will never ask for a card number.
This is Capcom’s second serious security incident. In 2020 a ransomware attack — software that locks a company’s computers until it is paid — hit its internal network. After that the company set up an outside security committee, and says it reported this incident to that committee on 20 October.
The one thing to remember
Your email address plus a real login date is enough to make a fake message look official. So do not judge a message by how much it seems to know about you. Close it, open the site yourself, and look there.
Image: LondonWater on Wikimedia Commons, CC BY-SA 4.0.