Capcom Confirms Data Breach Affecting 11.7 Million CAPCOM ID Accounts Globally

Capcom officially confirmed a data breach on October 22, 2026, impacting 11,774,247 CAPCOM ID accounts globally[1][3]. The breach exposed customer email addresses and system-specific identifier information, raising concerns for users worldwide[1][2][7].

This incident matters to readers because their exposed email addresses could be used in phishing campaigns, where malicious actors attempt to trick users into revealing sensitive information or installing malware[6][7]. Affected users are advised to be vigilant against fraudulent communications that may impersonate Capcom[6][7].

What the records show

Capcom's disclosure on October 22, 2026, stated that 11,774,247 CAPCOM ID accounts had their email addresses and system-specific identifiers compromised[1][3]. These identifiers included account creation dates, last login times, the total number of logins, and the IP address used during the last login[1][2][5]. For a smaller group of 43 accounts, additional personal details were exposed: date of birth, gender, country or region, and nickname[5][7]. While 196 CAPCOM ID accounts experienced unauthorized password changes, Capcom maintained that customer-set passwords were not leaked[3][5][13]. The company also confirmed that no credit card information was affected in the breach[3][5].

The timeline

The sequence of events began on October 19, 2026, when Capcom detected suspicious activity indicating potential unauthorized access to CAPCOM ID[3][7]. The company immediately initiated blocking measures and launched an investigation into the cause and scope of the incident[3][7]. By October 20, an internal task force was established to coordinate the response[11]. Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21, 2026[7][11]. The official public disclosure was made on October 22, 2026[1][3].

What changed and for whom

Following the breach, Capcom implemented emergency response measures and identified the attack method[3][13]. The company confirmed that services utilizing CAPCOM ID remain operational, allowing players to continue accessing their games[3][8]. For the 196 accounts where passwords were changed without authorization, Capcom has already reset those passwords[3][5]. The company stated it is continuing to investigate the extent of any further impact[3][9].

What the subject has said publicly

Capcom issued a public apology for the complications and concern caused to its customers and stakeholders[3]. The company stated it would notify affected customers about the incident[3][5]. Capcom advised users to be extremely cautious regarding potential phishing attempts, urging them to avoid clicking suspicious links or opening attachments in unexpected emails[6][7]. The company recommended that users access their accounts directly through official channels to verify any information[6][7].

What we could not confirm

Capcom's public statements did not explain the technical details of how the attackers gained initial access to its systems[11][14]. The specific method attackers used to change passwords for 196 accounts without reportedly leaking customer-set passwords was not detailed[11]. The identity of the third party responsible for the unauthorized access remains unconfirmed in the provided information[11].