More than 11.7 million Capcom accounts had email addresses and related account information exposed. The data included creation dates, last-login times, login counts, and last-login IP addresses. Attackers changed passwords for 196 accounts, while smaller subsets had additional profile details exposed; payment card data and most passwords were unaffected.
Why It Matters
The exposed information can support targeted phishing and convincing account-themed messages. Capcom’s online services remained available, and the company began notifying affected users. For leaders: non-payment account data still carries meaningful fraud and trust risk. For defenders: monitor for impersonation campaigns and unusual account recovery activity. The larger lesson is that behavioral account metadata can make social engineering more credible.
What Defenders Should Do
Warn affected users, strengthen monitoring around account recovery, and block messages that imitate Capcom support or request more information.