Capcom, the studio behind Resident Evil and Street Fighter 6, has officially confirmed a cyberattack on Capcom ID, the online membership system that underpins its games and services. According to the company, a third party gained unauthorized access to the platform.

capcomic

How the breach came to light

The incident was discovered on October 19, when Capcom noticed suspicious activity on Capcom ID. As soon as the activity — which pointed to potential unauthorized access — was detected, the company cut off access and launched a technical investigation.

That investigation produced an unwelcome finding: the unauthorized access had occurred well before it was detected. The attackers had already bypassed security measures and reached the user database.

Who was affected, and what data was exposed?

According to Capcom's official statement, more than 11.7 million users were affected in total. The vast majority of the leaked data consists of user email addresses. In addition, profile information — including date of birth, gender, country/region and nickname — was compromised for just 43 accounts.

The good news concerns payment data: Capcom confirmed that no credit card information was breached.

Services remain online, but stay alert

The company says the attack method has been identified and all necessary countermeasures have been completed. Every service that relies on the Capcom ID infrastructure remains active, and there is no disruption on any platform — including games like Street Fighter 6 that require a Capcom ID connection.

That said, the danger hasn't fully passed. Capcom warns that the leaked email addresses could be used for fraud through identity impersonation. Users are advised to be cautious with suspicious emails claiming to be from Capcom and to watch out for potential phishing attempts.