Capcom CAPCOM ID Breach Exposes 11.77 Million Emails, 196 Password Resets

The intrusion targeted the shared authentication platform used for Capcom games and services. Attackers extracted creation dates, login counts, last-login IPs, and altered passwords on 196 accounts while leaving stored credentials untouched. Capcom reset those passwords and notified regulators but provided no indicators of compromise or exploited vector in its notice. Procurement records and prior incident reports show Capcom suffered a 2020 Ragnar Locker ransomware event that exposed similar customer data stores. The current breach pattern—email harvesting at scale with minimal PII exfiltration—matches post-ransomware credential access followed by quiet persistence rather than smash-and-grab encryption. Official statements claim full service restoration and no password theft, yet the 196 forced resets imply either session hijacking or direct database write access that the company has not publicly scoped. Independent monitoring of Capcom job postings reveals no recent addition of dedicated identity or cloud security engineering roles, indicating limited internal capability to close the access path. Capcom has begun sequential customer outreach and established a dedicated contact channel. Expect secondary account takeovers to surface within 60 days unless the company publishes a post-incident report detailing the initial access method and MFA enforcement status across CAPCOM ID.