BODY: If you have ever linked Monster Hunter, Street Fighter 6, or an e-Capcom order to a CAPCOM ID, Capcom would like a word.
The Osaka publisher announced on October 22 that its online membership service, CAPCOM ID, was hit by unauthorized access that exposed customer information. According to the company, the leaked data includes some email addresses and system-specific identifiers. For a subset of users, the exposure went further: date of birth, gender, country/region, and account nickname.
The sharpest detail is the smallest number in the notice. Capcom says that on 196 accounts, attackers successfully changed the CAPCOM ID login password. Those accounts have since been force-reset. The company stresses that it has found no evidence that passwords set by users themselves were leaked — a careful phrasing that leaves open how the 196 changes were pushed through, and one reason the investigation is still open.
Capcom says its emergency response is complete and that services relying on CAPCOM ID are back online. It has reported the incident to police and to Japan's Personal Information Protection Commission, the regulator that administers the country's privacy law, and says it is now "closely examining the scope of impact."
The insider take
Anyone who covers Japanese games from Tokyo reads this notice with 2020 in mind. That November, Capcom was hit by the Ragnar Locker ransomware group in one of the industry's ugliest breaches, with personal data tied to hundreds of thousands of customers, employees, and business partners eventually caught up in it — and the confirmed numbers climbed over months of follow-up disclosures. The pattern to watch here is structural, not dramatic: Japanese corporate disclosure convention front-loads the apology, confirms only what is already verified, and revises figures upward in later notices. "Scope under investigation" is not reassurance, it is a placeholder. Under the amended personal information law, Capcom owes the PPC a fuller report within 30 days, so expect the real picture around late November. In the meantime, the practical advice is the unglamorous kind: reset your CAPCOM ID password, and retire it anywhere you reused it.
Originally reported by GAME Watch (Japanese).