PhishingCapcom
Capcom, the company behind Resident Evil, Monster Hunter and Street Fighter, says someone got into its CAPCOM ID service and exposed over 11.7 million account records, including email addresses, IP addresses and account activity. Card details weren’t affected. Capcom is warning that scammers could use the leaked details to send fake Capcom emails that look like the real thing, like one saying your account needs attention. A CAPCOM ID can be linked to PlayStation, Xbox, Steam, Epic and Nintendo accounts, so it’s worth locking down: someone had already changed the passwords on 196 accounts before Capcom reset them.
The move
Don’t tap links in any “Capcom” email — open your browser, go to cid.capcom.com yourself, and switch on two-factor authentication from your Account page so a stolen password alone won’t get anyone in.
Practise it: Would You Click? →
For teachers
Talking about this in class
After a breach like this, the scam to watch for is an email that looks completely genuine — right logo, right name, and real details about you, because they came from the leak. Ask the class: if an email from a company you actually have an account with says your account needs urgent attention, how would you check without trusting anything in the email itself?
The misconception worth surfacing is that a real-looking sender or a familiar logo means it’s safe. It doesn’t — those are the easiest parts to fake. A good answer lands on the habit: don’t tap the link, open the app or type the official site in yourself, and turn on two-factor so a leaked password isn’t enough on its own. A quick Would You Click? run practises reading where a link really goes, and going to the site yourself anyway.
If a student says they’ve already clicked and signed in on a fake page, they’re not in trouble and it isn’t their fault. The step that fits here: change the password on the real site straight away, turn on two-factor, and check any linked accounts — then pass it on through your usual school process.