CAPCOM ID breach exposes 11,774,247 records

CAPCOM ID users should be alert for messages impersonating Capcom after email addresses and account-related system data were exposed in a breach. Capcom’s October 22, 2026 notice puts the affected total at 11,774,247 records worldwide—not a confirmed count of individual users.

What information was exposed

The exposed system data included account creation times, last login times, login counts and the client IP address recorded at the last login. In 43 of the affected records, the exposed information also included dates of birth, gender, country or region, and nicknames.

Credit card information was not included in the breach.

196 accounts had unauthorized password changes

Passwords were changed without authorization on 196 affected accounts. Capcom has already reset those passwords; this was not a reset of every CAPCOM ID account.

Capcom has not confirmed that users’ original passwords were leaked. That does not guarantee that none were exposed.

The company detected and blocked suspicious access on October 19, established an internal response on October 20, and reported the incident to police and Japan’s Personal Information Protection Commission on October 21. Capcom says it has taken emergency measures and identified and addressed the attack method, while the broader investigation continues.

Handle account messages with care

Do not click links or open attachments in suspicious messages claiming to be from Capcom. Instead, navigate independently to the official CAPCOM ID portal or Capcom’s official notice.

CAPCOM ID and all games remain available, and Capcom says gameplay is unaffected. Users can continue using their registered email addresses. The company will contact affected customers individually.