Capcom Data Breach Exposes 11.7 Million Email Addresses

Capcom's CAPCOM ID service suffered a significant data breach that exposed nearly 12 million email addresses along with associated account metadata such as login timestamps and IP addresses, with a subset of users also losing sensitive personal data like dates of birth and gender. This incident highlights the critical importance of minimising the personal data stored in user account systems — a principle known as data minimisation — so that when breaches occur, the blast radius is limited. The exposure of IP addresses and login behaviour data further compounds the risk, enabling secondary attacks such as credential stuffing or targeted phishing. Gaming platforms and consumer-facing services are high-value targets precisely because they aggregate large volumes of personal data, making robust access controls, encryption at rest, and strict data retention policies essential safeguards.