CAPCOM ID breach: 11.7 million accounts' emails and login data exposed, what to do

Capcom has confirmed that an unauthorised party got into CAPCOM ID, the shared account system behind its web services and some of its online games, and that the email addresses and login metadata of 11,774,247 accounts worldwide were taken. The company says the passwords customers chose and their payment-card details were not part of the leak, but the data that was taken is exactly what phishers need: a verified, working email address tied to a Capcom account. Capcom announced the incident on 22 October 2026, three days after it first noticed the intrusion.

Key points

• Capcom detected signs of unauthorised access to CAPCOM ID on 19 October 2026 and published its public notice on 22 October 2026.
• The company says 11,774,247 accounts worldwide had their email address, account-creation date, last-login date, login count and last-login IP address exposed.
• For 43 of those accounts, date of birth, gender, country or region and nickname were exposed as well.
• Attackers changed the passwords of 196 accounts without authorisation; Capcom says it has reset them and is still investigating the impact.
• Capcom says customers' own passwords and credit-card information were not leaked, and that CAPCOM ID services and games stay available.

What to do

• Who is affected: anyone with a CAPCOM ID, the account used for Capcom's web services and some of its online games. Capcom says it will contact affected customers individually and in stages, so an email may take time to arrive.
• Treat unexpected mail with suspicion. Capcom itself warns that the leaked data could be used for phishing. Do not open links or attachments in messages that claim to come from Capcom or a related party, and go to the company's official site by typing the address yourself.
• Check your account. If you cannot log in with the password you know, that could mean your password was one of the 196 changed by the attacker. Capcom says it has reset those; use the official recovery flow, and contact support if it fails.
• Change the password anyway if you reused it elsewhere. Capcom says passwords were not leaked, but if the same password protects other services, a change costs a minute and removes the doubt. A password manager and two-step sign-in where offered make this routine.
• Support channels: Capcom set up a toll-free line for Japan (0120-801-271, 10:00 to 20:00), regional support pages for the Americas and for Europe, the Middle East and Africa (feedback@capcom.com for the latter), and info-asia@capcom.com for Asia outside Japan and for Oceania.

What happened

According to Capcom's own notice, the company found signs of unauthorised access to CAPCOM ID on 19 October. It blocked the access that day and confirmed that the intrusion had happened. On 20 October it set up an internal response headquarters, established that some customer data had leaked and that some account passwords had been changed without authorisation, and reported the matter to its external security oversight committee. On 21 October it informed the police and Japan's Personal Information Protection Commission. The public announcement followed on 22 October.

The scale is the headline. Capcom's notice lists 11,774,247 accounts whose email address and system identifiers were exposed. Those identifiers are the account-creation date, the date of the last login, the number of logins and the IP address used for the last login. BleepingComputer, which reported the story on the day of the announcement, rounds this to "more than 11.7 million customer email addresses". CyberInsider, which also covered it, points out that the company's detailed wording speaks of records rather than accounts, so the figure may not map one-to-one to people; we use "accounts" because that is how Capcom's notice and BleepingComputer's account of it describe the number, and flag the nuance here.

A far smaller group was hit harder. For 43 of those accounts, the attacker could also see date of birth, gender, country or region, and nickname. Those fields are optional profile data, which is probably why so few records carry them, though Capcom has not said that.

Separately, the attackers changed the login passwords of 196 accounts. Capcom has not said why, and its notice does not describe what the changes were meant to achieve. BleepingComputer reports the changes as having locked the owners out of their accounts. What the sources agree on is the action Capcom took: it reset those 196 passwords, and it says the investigation into the impact on those accounts continues.

Capcom says it has completed emergency measures and that it identified the way the intruder got in and added security measures. It has not shared how the initial access happened. Neither Capcom nor the outlets that reported the story name an attacker, and no group has been publicly identified in the sources we reviewed. We have also not found a claim of responsibility, a ransom demand or any sign that the data is being traded; if one appears we will add it as an update.

Background

This is not Capcom's first serious breach. In November 2020 the company was hit by the Ragnar Locker ransomware. The attackers claimed to have stolen 1 TB of data, and Capcom later warned that up to 390,000 people could be affected. In April 2021 Capcom said the attackers had entered through an old VPN device. Those details come from BleepingComputer's background section on the new incident.

The two incidents differ in kind. The 2020 attack was ransomware against the company's internal network; this one, on Capcom's account, concerns a customer-facing identity system. That matters because an account system is a single place where the email addresses of tens of millions of customers meet usage data. CAPCOM ID is shared across Capcom's web services and some online games, so an intrusion there reaches customers of many titles at once.

The numbers

Capcom's figures show a pyramid: a very large pool with minimal data, a tiny group with more personal profile fields, and a smaller group with direct account tampering.

type: bar
title: CAPCOM ID accounts affected, by what happened to them
unit: accounts
source: Capcom announcement of 22 October 2026
highlight: Email and login data exposed
Email and login data exposed | 11774247
Password changed by attacker | 196
Birth date, gender, country, nickname also exposed | 43

The chart shows why the bulk exposure matters more than the dramatic details. Most of the risk comes from the 11.7 million: not because any single record is sensitive, but because a list of verified addresses that all belong to people who play or follow Capcom games is a ready-made target list for scams that look plausible. A message saying "your Capcom account has been compromised, click here" will land with real account owners.

The last-login IP address is the most sensitive of the common fields. An IP address can hint at a rough location and the internet provider. Capcom does not say that it can be tied to a name, and in the 43 accounts with a nickname and a birth date the combination is more identifying than in the rest.

What it means

For players. The practical risk is phishing, and Capcom says so itself. The attacker does not have your password, according to the company, so the usual advice about changing it is a precaution rather than an emergency. The sharper advice is about behaviour: do not treat any email that mentions your Capcom account as trustworthy because it knows your address. Sign-in links and "verify your account" messages should be reached by typing the site address, not by clicking.

For anyone running an account system. The incident is a reminder of how little data it takes to make a breach matter. The exposed fields are metadata (a login count, a last-login time), not secrets. Yet together they let a scammer write messages that mention real activity and sound informed. Minimising what an account system stores, and how long it keeps it, limits what a breach can show.

For regulators and the company. Capcom reported the incident to Japan's Personal Information Protection Commission within two days of confirming the leak. With customers in many regions, it has set up separate support routes for each. How far each region's rules require direct notification will determine who gets an email, and Capcom has said it will notify customers in stages.

What we don't know yet

• How the attacker got in. Capcom says it identified the method and added measures but has not said what the method was.
• Who is responsible. No group is named in Capcom's notice or in the coverage we reviewed.
• How long the attacker had access. Capcom dates its detection to 19 October; none of the reports we reviewed say when the intrusion began.
• Whether the data is being sold or published. We found no report of that.
• Why 196 passwords were changed. Capcom says it reset them and is still investigating the impact.
• Whether records equal people. The detailed wording refers to records, so the number of distinct customers could be lower than 11,774,247.

What to watch next

Watch Capcom's own notice for updates to the numbers, since the company says its investigation continues. Watch for a claim of responsibility or a leak-site listing, which would raise the risk of the data circulating. Watch for the notification emails: when they arrive, check that they point to Capcom's real domain and do not ask for a password. And watch for phishing campaigns that quote this incident, which are likely in the weeks after any large breach.

Sources

• Capcom: notice about unauthorised access to CAPCOM ID, 22 October 2026 (primary source)
• BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts
• CyberInsider: Capcom discloses data breach affecting 11.7 million accounts worldwide