Capcom Breach Affects 11.7 Million CAPCOM ID Accounts
Capcom Data Breach Exposes Data of Over 11 Million Users
Impact Scope
People Affected
11.7 million
Industries Affected
Related Entities
Organizations
Products & Tech
Other
MITRE ATT&CK Techniques
Full Report
Executive Summary
On October 22, 2026, Japanese video game giant Capcom confirmed a major data breach affecting its CAPCOM ID membership service. The breach, detected on October 19, compromised the personal information of over 11.7 million users. Exposed data includes email addresses, IP addresses, and login metadata. While credit card information was not affected, the scale of the breach exposes a large user base to follow-on phishing and social engineering attacks. Capcom has reported the incident to Japanese authorities and is notifying affected users while urging caution regarding suspicious communications.
Threat Overview
What Happened: Unauthorized actors gained access to the database of Capcom's CAPCOM ID service, a centralized authentication system for its games and online services.
When: The suspicious activity was detected on October 19, 2026. The breach was publicly disclosed on October 22, 2026, after an initial investigation.
Who is Affected: Over 11.7 million registered users of the CAPCOM ID service. The company has a global user base for its popular franchises like Resident Evil and Street Fighter.
What Data Was Exposed:
- For 11.7 million users: Email addresses, account creation dates, last login timestamps, number of logins, and the IP address of the last login.
- For a subset of 43 accounts: Dates of birth, gender, nicknames, and countries.
- For 196 accounts: Passwords were illicitly changed by the attackers, but Capcom has since reset them.
Capcom has emphasized that no credit card data was compromised, as payment processing is handled by third-party services. The primary attack vector has not been disclosed, but the incident follows a 2020 ransomware attack on the company that exploited a legacy VPN device.
Technical Analysis
The exact TTPs used in this breach have not been publicly detailed by Capcom. However, based on the type of data exfiltrated, the attack likely involved the compromise of a web application or database server connected to the CAPCOM ID service. Potential attack vectors could include SQL injection, exploitation of an unpatched vulnerability in the web framework, or the use of stolen credentials for a privileged account.
Analyst Assessment: The attackers' actions, such as changing passwords for a small number of accounts, suggest an attempt to take over high-value accounts or test the extent of their access. The exfiltration of metadata like IP addresses and login timestamps indicates a reconnaissance effort, potentially to build profiles of users for targeted phishing campaigns.
MITRE ATT&CK Techniques Potentially Used:
- Initial Access:
T1190 - Exploit Public-Facing Application: A likely vector if an unpatched vulnerability existed in the CAPCOM ID portal.
- Credential Access:
T1187 - Forced Authentication: Could have been used to capture credentials if a system was misconfigured.
- Collection:
T1530 - Data from Cloud Storage Object: If the user database was stored in a cloud environment.T1213 - Data from Information Repositories: Accessing and extracting data from the primary user database.
- Exfiltration:
T1041 - Exfiltration Over C2 Channel: Data could have been funneled out through a command-and-control channel.
Impact Assessment
The primary impact is the heightened risk of targeted phishing campaigns against the 11.7 million affected users. Attackers can use the stolen email addresses and the context of the Capcom breach to craft highly convincing emails designed to steal further personal information, login credentials for other services, or deploy malware. The exposure of IP addresses could also aid in geolocation and more sophisticated targeting. For Capcom, the breach causes significant reputational damage, particularly following the 2020 ransomware incident, and may lead to regulatory fines under data protection laws like GDPR, even though the company is headquartered in Japan.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) such as malicious IP addresses, domains, or file hashes were provided in the source articles.
Cyber Observables — Hunting Hints
The following patterns could indicate related malicious activity targeting Capcom users:
- Email Subject Lines: Look for emails with subjects like "CAPCOM ID Security Alert," "Your Capcom Account Requires Verification," or "Resident Evil Special Offer Following Breach." Attackers will leverage the breach news.
- Sender Domains: Monitor for emails from domains that are look-alikes of
capcom.com, such ascapcom-security.com,capcom-support.net, or using character substitutions. - URL Patterns: Phishing links may contain
capcomas a subdomain (e.g.,capcom.security-update.com) to appear legitimate.
Detection & Response
- For Users:
- Treat all unsolicited emails, even those appearing to be from Capcom, with extreme suspicion.
- Do not click on links or download attachments from these emails. Navigate directly to the official CAPCOM ID website (
cid.capcom.com) to make any account changes. - Enable Multi-Factor Authentication (MFA) on your Capcom account and any other online account that uses the same email address.
- Monitor for any unusual activity on your accounts.
- For Organizations:
- Email Gateway Filtering: Implement strict email filtering rules to block known phishing indicators and look-alike domains related to this breach.
- User Awareness: Alert employees, especially if corporate emails were used for personal services, about the breach and the expected phishing campaigns. Use this as a real-world training example.
- D3FEND Techniques: Employ
D3-UA - URL Analysisto scan and detonate links in incoming emails to identify malicious destinations.
Mitigation
- For Users:
- Password Hygiene: While Capcom stated passwords were not breached (except for 196 accounts), it is a best practice to have a unique, strong password for every service. If the email and password combination used for Capcom is reused elsewhere, change those passwords immediately.
- Be Vigilant: Be aware that attackers now know your email is associated with a gaming account. Expect targeted attacks related to gaming, virtual items, and account trading.
- For Organizations (General Best Practices):
- D3FEND Hardening: Implement
D3-ACH - Application Configuration Hardeningon all public-facing applications to minimize the attack surface. - Data Minimization: Collect and retain only the user data that is strictly necessary for the service to function.
- Network Segmentation: Isolate databases containing sensitive user information from public-facing web servers. Access should be strictly controlled through an application layer with robust authentication and authorization checks.
- D3FEND Hardening: Implement
Timeline of Events
MITRE ATT&CK Mitigations
Regularly patch and update public-facing applications and their underlying components to prevent exploitation of known vulnerabilities.
Train users to recognize and report phishing attempts that are likely to follow a data breach announcement.
Enforce MFA on all user accounts to prevent takeovers even if credentials are stolen in a separate attack.
Securely configure web applications and databases to prevent common attack vectors like SQL injection and improper access control.
D3FEND Defensive Countermeasures
Implement Multi-factor Authentication (MFA) for all CAPCOM ID accounts. Given that email addresses are compromised, attackers will likely attempt credential stuffing attacks across the web. Requiring a second factor (e.g., an authenticator app, hardware token, or biometric) provides a critical defense layer, rendering stolen or guessed passwords useless for account takeover. Priority should be given to accounts with linked payment methods or extensive purchase histories. For implementation, Capcom should consider offering multiple MFA options to accommodate a diverse global user base and strongly incentivize or mandate enrollment, especially after a user's password is changed or a login occurs from a new device or location. This directly mitigates the risk of account takeovers, which was demonstrated by the attackers changing 196 passwords.
Corporate security teams should enhance their email security gateways to perform rigorous URL analysis on all incoming emails, particularly those referencing Capcom or the data breach. Automated sandboxing (detonation) of URLs is crucial to identify phishing sites designed to harvest more credentials. Rules should be configured to flag or block emails containing URLs with look-alike domains (e.g., 'capcom-security.com') or those using URL shorteners. Since attackers know the victims are gamers, phishing sites may be themed around new game releases or exclusive content. Analyzing these URLs for suspicious redirection chains, non-standard port usage, or recently registered domains can effectively neutralize the primary post-breach threat to users and employees.
Capcom's internal security team should implement Resource Access Pattern Analysis to detect future breaches. This involves baselining normal access to sensitive databases like the CAPCOM ID user store. By monitoring for anomalies—such as a web server process suddenly attempting to dump an entire table, access from an unusual internal IP, or queries running outside of normal business hours—the security team can detect an attack in progress. For this breach, such a system might have alerted on the large-scale exfiltration of 11.7 million records, allowing for a faster response. Tools like a Database Activity Monitoring (DAM) solution can provide the necessary telemetry. This moves beyond simple perimeter defense to actively hunting for malicious behavior within the network.
Timeline of Events
Capcom suffers a ransomware attack by the Ragnar Locker gang.
Capcom detects suspicious activity and unauthorized access to its CAPCOM ID systems.
Capcom reports the incident to Japanese police and the Personal Information Protection Commission.
Capcom publicly discloses the data breach.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.