Capcom data breach exposes details from over 11 million Capcom ID accounts

Capcom has confirmed a data breach involving information tied to more than 11 million Capcom ID accounts. If you have ever made a Capcom ID, for example to play Street Fighter 6 online, your email address may be among the details that were exposed, and Capcom is warning that phishing emails could follow.

What Capcom says happened

The publisher behind Resident Evil, Street Fighter and Monster Hunter says a third party gained access to information linked to the accounts, according to Rock Paper Shotgun. Capcom first spotted "suspicious activity" around the service on October 19, and has spent the days since working to contain the problem.

IGN describes the affected system as Capcom's online membership service and puts the total at more than 11 million customer accounts.

Rock Paper Shotgun notes that a Capcom ID is required to play games like Street Fighter 6 online, so the affected accounts include ones that players use to get into Capcom's games, not just its websites.

What information was involved

According to PC Gamer, the data caught up in the breach includes:

• Email addresses
• IP addresses
• Birthdays

Those three details together are exactly what a convincing scam email needs. Someone who knows your email address and date of birth can write a message that looks like it really came from an account you own.

The phishing warning

That is why Capcom is telling players to be on guard for phishing attempts, as both IGN and Rock Paper Shotgun report. Phishing emails pretend to come from a trusted company to trick people into clicking links or handing over login details.

In practice, the safest approach for the next while is to treat any unexpected email claiming to be from Capcom with suspicion. If a message asks you to log in, reset something or confirm details, go to Capcom's site or the game directly rather than using a link in the email.

What to do now

If you have a Capcom ID, PC Gamer's advice is short: check your email. Keep an eye out for messages that try to use the breach as a hook, and be wary of anything that asks for your password or personal details.