Capcom Confirms CAPCOM ID Data Breach Affecting 11.7 Million Records
Unauthorized access to CAPCOM ID affected 11,774,247 email address records containing account activity data. Capcom warns of phishing risks.
The CAPCOM ID data breach affected 11,774,247 email address records along with selected account activity data. Capcom confirmed the incident on October 22, 2026, stating that a third party accessed its CAPCOM ID service without authorization.
According to the company’s notice, the affected records contained an email address, account creation time, last login time, number of logins, and the IP address used during the last login. The figure refers to email address records with associated data, so it may not represent the same number of unique people or active accounts.
The CAPCOM ID data breach also includes a limited amount of additional data
Additional data was exposed in 43 records: date of birth, gender, country or region, and nickname. Capcom also stated that passwords were changed without authorization on 196 accounts. The company has already reset these passwords.
Capcom has not confirmed the exposure of passwords originally set by users or payment card data. However, the disclosed information could support convincing phishing campaigns targeting Capcom players.
Company cites emergency measures while services remain operational
The publisher says it introduced emergency measures after discovering the incident and identified the attack method used, which it is addressing. According to the company, CAPCOM ID and its games remain available.
Capcom reported the incident to the Osaka police and Japan’s Personal Information Protection Commission on October 21. The company has not disclosed the exact method of the initial intrusion, the attacker’s identity, or the full scope of the incident. The investigation is ongoing.
Beware of messages impersonating Capcom
Capcom directly warned users about messages impersonating the company or related entities. The incident could be misused in phishing targeting Capcom players.
CAPCOM ID users should verify the sender’s address and avoid opening unsolicited links or attachments. If a message appears suspicious, it is safer to open the service directly through a known official website.
Further information may come from notices to affected users, any regulatory filings, and the results of the ongoing investigation. Users should also watch for phishing campaigns that exploit Capcom’s name or this incident.
Sources
- Capcom – Notice and Apology Regarding Customer Information Affected Through Unauthorized Access – Officially confirms the incident, the scope of 11,774,247 records, data categories, 196 changed passwords, service status, emergency measures, and timeline.
- BleepingComputer – Capcom confirms data breach affecting 11.7 million accounts – Independently summarizes Capcom’s notice and notes that the company did not disclose technical details about the initial access.
Verified and updated: October 23, 2026 06:25
