Capcom confirmed a data breach on 22 October 2026 that exposed 11,774,247 CAPCOM ID records. The Capcom data breach covers email addresses, account creation and last-login times, login counts and last-login IP addresses; 196 accounts had their passwords changed without permission. The company has not confirmed any compromise of customer-set passwords.
What the Capcom Data Breach Exposed
The breach exposed contact and sign-in metadata, not payment details. Capcom Co., Ltd., the Osaka game publisher behind Street Fighter, Monster Hunter and Resident Evil, broke the affected information into three tiers in its notice.
| Information exposed | Records affected |
|---|---|
| Email address, account creation date and time, last login date and time, login count, IP address used at last login | 11,774,247 |
| Date of birth, gender, country or region, nickname | 43 |
| Password changed without authorisation | 196 |
Two categories sit outside that list. Capcom says it has not confirmed that any password a customer set themselves was compromised, and on card data the company is unambiguous: “Credit card information was not included among the affected information,” according to Capcom’s notice of 22 October 2026.
The 196 figure is the part that matters most to the people in it. Those account holders did not lose data so much as lose access, and Capcom has since reset those passwords itself.
Whose Accounts Are Affected
Anyone with a CAPCOM ID is potentially in the 11.77 million, wherever they live. CAPCOM ID is the single membership account that signs players into Capcom’s web services, community features and online multiplayer, so the exposure is not limited to one game or one console.
Capcom described the affected records as worldwide and did not publish a country-by-country split. The 43 records with birth dates and nicknames attached are the narrow high-risk group, and Capcom says it will contact affected customers directly rather than leaving them to work it out.
Playing is unaffected. Capcom says games and services that rely on CAPCOM ID remain available, and it has not taken the login system offline.
What to Do Now
Reset your password and assume your inbox is now a target. Four steps cover it:
- Reset your CAPCOM ID password: Open Capcom’s site by typing the address yourself, then change the password from inside your account rather than through any link sent to you.
- Stop reusing that password: If the same password opens your email, store or bank accounts, change it there too. An exposed email address plus a password reused from another breach is the combination that gets accounts taken over.
- Expect phishing that knows your name: Attackers now hold a verified list of nearly 12 million addresses belonging to confirmed Capcom players, which makes a fake “security alert” far more convincing than a random scam.
- Treat an unrequested reset email as a warning: A password-reset message you did not ask for suggests someone is working on your account, not that Capcom is helping you.
Capcom’s own advice stops at the last two points: it tells customers to be wary of fraudulent messages impersonating the company and to avoid opening links or attachments in suspicious messages. The pattern is familiar from other consumer platform breaches this year, including the Weverse breach that hit payment logs but not card numbers.
How to Tell a Real Capcom Message From a Fake One
Capcom published its support routes, and a genuine message will point to one of them. The company listed a dedicated channel for each region in its notice:
- Japan: A toll-free support line on 0120-801-271, open 10:00 to 20:00 JST.
- North, Central and South America: The Capcom USA customer support inquiry form.
- Europe, the Middle East and Africa: The Capcom Europe inquiry form, or [email protected].
- Asia excluding Japan, and Oceania: [email protected].
Nothing on that list asks you to confirm a password, a card number or a one-time code by email. A message that does is not from Capcom, however closely the sender address matches — and phishing kits no longer need your password to work, as the EvilTokens service that hijacked Microsoft 365 accounts showed.
How the Breach Was Found and Reported
Capcom moved from detection to public disclosure in four days. Its notice sets out the sequence:
- 19 October 2026: Capcom detected suspicious activity, blocked the access, confirmed that unauthorised access had occurred and began identifying the attack method.
- 20 October 2026: It set up an internal incident response headquarters, confirmed that customer information had been accessed and informed its external Information Technology Security Oversight Committee.
- 21 October 2026: It reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission, the national privacy regulator.
- 22 October 2026: It published the notice and apology naming the figures above.
As of 23 October 2026, those figures are the latest Capcom has confirmed, the investigation is still open, and the company has not announced any revision to the record counts. Capcom says it “takes this matter extremely seriously and will continue its detailed investigation”, and that it will post updates if further facts need disclosure.
What Capcom Has Not Explained
The notice says what was taken but not how. Three questions are still open:
- The entry point: Capcom says it has identified and addressed the attack method but has not described it, named a vulnerability or identified who was responsible.
- The password changes: The company has not explained how an attacker altered passwords on 196 accounts while, on its own account, the passwords customers set were not compromised.
- When it started: 19 October is the date Capcom detected the activity, not a stated start date for the intrusion. How long the access lasted before that has not been disclosed.
This is Capcom’s second disclosed incident of this kind. A Ragnar Locker ransomware attack in November 2020 reached personal data belonging to roughly 350,000 customers, business partners and employees, a far smaller group than the one in this week’s notice, though that attack exposed names and addresses rather than login metadata. Readers who have been through a document-level exposure will recognise the sharper version of this problem from the Revolut breach that released passport copies.
Frequently Asked Questions
Was My Capcom Password Stolen?
Capcom says it has not confirmed that any password set by a customer was compromised. It did confirm that 196 accounts had their passwords changed by someone else, and it has reset those.
Was Credit Card Information Involved?
No. Capcom states that credit card information was not included among the affected information.
How Do I Know if My Account Is One of the 11,774,247?
Capcom has not published a lookup tool. It says it will contact affected customers directly, so wait for a notice from Capcom and open your account by typing the address yourself rather than clicking a link.
Can I Still Play Capcom Games Online?
Yes. Capcom says games and services that use CAPCOM ID remain available, and registered email addresses can continue to be used.
How Did the Attackers Get In?
Capcom has not said. It says it identified and fixed the method used, but it has published no technical detail and has not named anyone responsible.
