Capcom said on Oct 22 that a third party got unauthorized access to customer data tied to CAPCOM ID, its unified account for web services and online play. Affected: 11,774,247 records of email addresses plus account metadata (creation date, last-login time, login count and last-login client IP). For 43 of those, date of birth, gender, country/region and nickname were also exposed. Capcom says the attacker changed the passwords on 196 accounts, which have been reset. It has found no sign that customer-set passwords were compromised, and no card data was involved. Services stay online and affected customers will be notified.

Expect: Capcom-themed phishing to the leaked addresses. Users should turn on two-step verification and treat "your CAPCOM ID" emails with care.