Capcom ID breach exposes email addresses and login details of 11.77 million account records
Capcom says attackers took 11.77 million CAPCOM ID records (emails, login dates, last IP address) and changed passwords on 196 accounts, now reset. Expect phishing pretending to be Capcom. Don't click links in unexpected messages; no card data was involved.
Treat any email claiming to be from Capcom as suspect: don't open links or attachments in unexpected messages, and go to Capcom's site directly. If you reuse your Capcom password elsewhere, change it and turn on two-step verification where offered.
What’s happening
Capcom, the Japanese maker of Resident Evil and Street Fighter, disclosed on 22 October 2026 that someone gained unauthorised access to CAPCOM ID, the account system shared across its games and services. Capcom found the access on 19 October and blocked it. The exposed data covers 11,774,247 records worldwide: email addresses plus account creation date, last login date, login count and the IP address used at last login. For 43 of those records, date of birth, gender, country or region and nickname were also exposed. Attackers changed the passwords on 196 accounts; Capcom has reset them. Capcom says it has not confirmed that customers' own passwords were leaked, and that no credit card information was involved. It has told the police and Japan's privacy regulator, and will contact affected customers in stages. Capcom has not said how the attackers got in, and no group has claimed responsibility. Capcom's notice does not say whether each record is a unique person, so the number of people affected may be lower. No later update from Capcom was found as of 3 November 2026. Games and CAPCOM ID services remain available.
- What
- Breach
- Affects
- Capcom ID (Capcom game account system)
- Fixed in
- Nothing to patch
- Since
- 19 Oct 2026
Timeline
- Update
BleepingComputer reported the disclosure, noting Capcom has not shared how the attackers got in and that no group has claimed responsibility.
- Made publicNothing to patch
Capcom published its notice: 11,774,247 records with email addresses and login metadata exposed, extra personal details for 43, and 196 accounts with passwords changed by the attackers and since reset. It said credit card data was not involved.
- Update
Capcom reported the incident to the police and to Japan's Personal Information Protection Commission.
- Update
Capcom set up an internal response headquarters and confirmed customer data had leaked and that some accounts had passwords changed without authorisation. It reported to its external security oversight committee.
- Made public
Capcom says it detected signs of suspicious access to CAPCOM ID, blocked it, confirmed unauthorised access that day and began emergency measures.
Sources
- Notice of unauthorized access to CAPCOM IDCapcom · 22 Oct 2026
- Capcom confirms data breach affecting 11.7 million accountsBleepingComputer · 22 Oct 2026