If you have a Capcom ID, watch your inbox. Capcom says an unauthorized third party got into its CAPCOM ID membership service, and 11,774,247 email addresses were caught up in it. Affected users should receive a notification email from the company.
The leaked records for those addresses include system-level details: when the account was created, when it last logged in, and the IP address used for that last login. A far smaller group, 43 accounts, also had dates of birth, gender, country or region, and nickname exposed. Capcom said no credit card information was involved.
Then there is the number that is easy to skip: 196 accounts had their passwords changed by the intruder. Capcom said it has reset them and has not confirmed any leak of passwords customers set themselves. Still, changing a password means doing something to an account, not just reading from it. Capcom said it is still investigating the extent of the access, so that count could move.
The company's timeline is short. It said it detected the breach on October 19, blocked access on discovery, formed a task force on October 20, and reported to the police and Japan's Personal Information Protection Commission on October 21. Capcom also said it has completed emergency measures and identified the attack methods, though that is the company's own account.
For most of the 11.77 million, the realistic risk is phishing rather than stolen money. An email address paired with login history is enough to write a convincing fake message, and Capcom itself warned of emails impersonating it or similar companies. Using a unique password on each account, ideally through a password manager, limits the damage if one service leaks.
The open question is how an attacker got far enough to reset passwords on 196 accounts, and whether Capcom's investigation adds to any of these tallies.