卡普空CAPCOM ID再遭网络攻击，全球约1,177万账号信息泄露

Japanese game developer Capcom has suffered another cyberattack, six years after its previous breach. Information associated with more than 11.77 million Capcom accounts worldwide has been leaked.
Capcom announced Oct. 22 local time that its online membership service, CAPCOM ID, had been accessed without authorization by an external attacker, exposing 11,774,247 account records.
CAPCOM ID is an integrated account system for Capcom’s web services and certain online games. It is used to link platform accounts for online games such as Street Fighter 6, allowing users to play multiple games through a single account.
The exposed information includes email addresses, account creation dates, last login times, login counts and internet protocol (IP) addresses from the most recent access. For 43 accounts, dates of birth, gender, country and nicknames were also exposed.
Capcom also confirmed that attackers had changed user-set passwords without authorization on 196 accounts.
According to Capcom, the company detected suspicious access activity on Oct. 19 and launched an investigation. It confirmed the data breach and unauthorized password changes on Oct. 20, then reported the incident to Japanese police and the Personal Information Protection Commission on Oct. 21.
Capcom did not disclose the specific intrusion method or the number of affected users in South Korea.
The incident comes six years after Capcom suffered a major cyberattack in 2020.
In November 2020, a ransomware attack disrupted Capcom’s internal network and exposed personal information. Its final investigation report, released in April 2021, confirmed that 15,649 people had been affected by the data breach. The number of potentially affected individuals was estimated at up to approximately 390,000.
Investigators found that the attackers had entered Capcom’s internal network through outdated virtual private network (VPN) equipment at its North American subsidiary.
Following the incident, Capcom established a security oversight committee involving external cybersecurity experts and strengthened its account management and security monitoring systems. However, the latest breach, six years later, has raised questions about the effectiveness of those measures.
South Korean game companies have also experienced numerous security incidents.
In November 2011, Nexon suffered a breach exposing the personal information of 13.2 million MapleStory members, affecting 73% of its 18 million registered users at the time. In November 2025, Netmarble suffered a breach involving the personal information of 6.11 million people. Hackers compromised a PC gaming portal offering games such as Go and Korean chess, exposing names, dates of birth and encrypted passwords belonging to users and current and former employees.
Approximately 31 million IDs and encrypted passwords from dormant accounts, which had been stored without personally identifiable information, were also leaked. A subsequent investigation by Netmarble identified an additional 8,048 personal information records belonging to customer service users and former job applicants, including 1,304 resident registration numbers.
NC experienced a security incident in 2005 when a Lineage 2 update caused user IDs and passwords to be stored unencrypted in access logs. An estimated 400,000 to 500,000 users accessed the game during the affected period. A court subsequently found that NC had violated its obligation to protect personal information and ordered compensation for some victims.
In 2022, Smilegate experienced an account hijacking incident involving its Stove gaming platform. Attackers exploited a mobile game’s login process to gain access to Lost Ark accounts. Some users had in-game currency and items stolen.