Capcom confirms 19 CAPCOM ID customer records affected after unauthorised access
Capcom says an unauthorised third party accessed 19 Japanese CAPCOM ID customer records, while credit-card information was not included.
Capcom says an unauthorised third party accessed the e-Capcom account pages of 19 CAPCOM ID accounts after passwords were changed without permission. The company’s latest update narrows the incident to those 19 records in Japan and says credit-card information was not included.1
The update matters because earlier reporting around the incident had repeated a much larger figure without support from Capcom’s own notice. The company’s official statement does not say that 11.7 million accounts were compromised, so that number should not be treated as established fact.1
What Capcom says happened
Capcom says it identified unauthorised password changes affecting 196 CAPCOM ID accounts. During its follow-up investigation, it found that an unauthorised third party had accessed the e-Capcom account pages of 19 of those accounts. E-Capcom is Capcom’s online store in Japan, while CAPCOM ID is the unified account system used to access several Capcom web services and, in some cases, online game features.1
The affected information included names, Japanese phonetic name details, telephone numbers, postal codes, addresses, gender, dates of birth, purchase history, e-Capcom customer-enquiry history and saved address-book information. Capcom describes the impact as 19 affected records in Japan.1
Capcom also says the other accounts did not show evidence of information being compromised as a result of the unauthorised password changes. It has completed its investigation into the scope of the impact, but says it will continue monitoring CAPCOM ID and related services and strengthen its information-security measures.1
What affected customers should watch for
Capcom warns that the affected information could be misused in fraudulent texts, phone calls or other messages pretending to come from Capcom or related organisations. The company advises customers not to open suspicious attachments or visit URLs included in unexpected communications.1
Capcom says it will contact customers affected by the incident. It has also published dedicated support routes for customers in Japan, the Americas, Europe, the Middle East, Africa, Asia and Oceania. The company’s European and North American support notices point customers towards its Capcom support request form, while other regions are given dedicated email or telephone details.1
The practical lesson is straightforward: do not assume that a message is genuine merely because it mentions a real purchase, account detail or Capcom service. If a message asks for a password, payment detail or urgent sign-in, use the support page reached through Capcom’s official website rather than clicking the message’s link.
The story’s hero is an abstract matrix-code image by Markus Spiske, used under the Pexels licence as a cybersecurity illustration rather than as a photograph of Capcom’s systems.2
Our opinion
Capcom’s correction is more useful than the sensational figure that circulated around the first reports. Nineteen affected records is still serious: the exposed categories include enough personal information to make convincing impersonation attempts plausible. But accuracy matters just as much in a data-security story as it does in a game announcement. Treating an unsupported account total as fact would inflate the incident and make it harder for customers to understand the risk that Capcom has actually confirmed.
The important detail is the combination of unauthorised password changes, access to e-Capcom account pages and the types of personal information involved. Customers should take Capcom’s warning about phishing and impersonation seriously, while relying on the company’s official support channels for any follow-up. At this stage, Capcom’s own update supports a confirmed impact of 19 records in Japan, not a compromise of 11.7 million accounts.