Resident Evil developer Capcom confirms breach involving more than 11.7 million account records

Capcom has confirmed that a major cyber attack exposed information connected to more than 11.7 million CAPCOM ID records, raising concerns for players of some of its biggest games.

The Japanese publisher behind various hit series like Resident Evil, Monster Hunter, and Street Fighter discovered suspicious activity on October 19 and later established that an unauthorised third party had accessed customer information.

CAPCOM ID is the company's account service for online gaming and other web features, meaning the incident potentially affects players across its franchises.

What information was exposed in the Capcom data breach?

In a press release on October 22, Capcom revealed that 11,774,247 records worldwide were affected, including email addresses, account creation dates, login histories, and IP addresses used during the last login.

A smaller group of 43 records also contained dates of birth, gender, nicknames, and countries or regions. The company also identified 196 accounts where passwords had been changed without their owners' permission.

The developer explained: “Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves.” Those 196 passwords have since been reset.

A further Capcom update on October 23 confirmed that the intruder had accessed the e-Capcom online store account pages belonging to 19 of those customers.

The information exposed there included names, telephone numbers, home addresses, dates of birth, purchase histories, and saved address book details. Capcom stressed that credit card information was not affected, while CAPCOM ID services and its games remain accessible.

The publisher has addressed the method used in the attack and is contacting affected customers. It has also warned that stolen details could be used to send convincing messages pretending to come from Capcom.

The statement added: “If you receive any suspicious email or other communication, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.”

Capcom has suffered attacks before, alongside other gaming security incidents

This is not the first time Capcom has faced a significant cyber attack. In November 2020, Capcom confirmed a ransomware incident compromised data belonging to 16,415 people, with the publisher warning that as many as 390,000 could potentially have been affected.

Other gaming companies have encountered security problems of their own in 2026.

In August, for instance, Valve contacted European Steam customers after hackers targeted CEVA Logistics, a company responsible for delivering its hardware. Names, addresses, telephone numbers and order details were among the information believed to have been exposed, although Steam account passwords and payment information were not included.

Earlier in May, PlayStation Network users reported account takeovers (starting with Last Stand Media founder and Sacred Symbols: A PlayStation Podcast host, Colin Moriarty) involving attempts to convince support staff to transfer control using account identifiers and older transaction information.