Capcom confirms 11.7 million CAPCOM ID records exposed and resets 196 hijacked passwords

Capcom has confirmed that unauthorized access to its CAPCOM ID membership service exposed 11,774,247 email address records worldwide, putting the Japanese game publisher at the center of a large account-security incident. The company said it detected the intrusion on October 19, 2026 and blocked the access the same day. It published a first notice on October 22, 2026 and a second update on October 23, 2026 that narrowed the impact of unauthorized password changes to 19 e-Capcom store accounts in Japan.

CAPCOM ID is the unified account for Capcom's web services and, for certain games, online play. It sits behind websites, support flows and linked platform accounts, which is why a breach involving email addresses and account metadata can reach beyond one game or storefront. Capcom said games and CAPCOM ID services remain available and that gameplay has not been affected.

The 11,774,247 records contained email addresses plus system-specific identifiers such as account creation date and time, last login date and time, number of logins, and the client IP address at last login. A much smaller group of 43 records also exposed date of birth, gender, country or region and nickname. Separately, 196 accounts had their CAPCOM ID login passwords changed without authorization. Capcom said it has not confirmed compromise of passwords originally set by customers, that the 196 passwords have been reset, and that credit card information was not included.

The disclosure followed a fast internal sequence. Capcom said it confirmed the intrusion on October 19, 2026, set up an internal incident response headquarters on October 20, 2026, and reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21, 2026. By the first public notice, Capcom said emergency measures were complete and the attack method had been identified and addressed.

Key Facts

Capcom disclosed on October 22, 2026 that the unauthorized access exposed 11,774,247 CAPCOM ID records worldwide. The records include email addresses and system-specific identifiers: account creation date and time, last login date and time, number of logins, and the client IP address at last login. For 43 records, the exposed data also included date of birth, gender, country or region and nickname. Credit card information was not included, Capcom said.

The password impact is limited but serious. Capcom said attackers changed login passwords on 196 accounts. The company said it has not confirmed that customer-chosen passwords were compromised, and it has already reset the 196 affected passwords. In its October 23, 2026 update, Capcom said an unauthorized third party accessed the e-Capcom account pages of 19 of those accounts. e-Capcom is Capcom's online store in Japan.

For the 19 records, Capcom listed the affected information as name, name in Japanese phonetic characters, telephone number, postal code, address, gender, date of birth, purchase history, e-Capcom customer inquiry history, and saved address book information. Capcom said all 19 are in Japan, that it will notify the customers individually, that credit card information was not among the leaked data, and that for the remaining accounts it found no information compromised as a result of the unauthorized password changes.

SecurityWeek reported on October 23, 2026 that the stolen data includes email addresses, account metadata and IP addresses, and it noted that the 11.7 million figure counts records rather than necessarily unique users. Malwarebytes reported on October 23, 2026 that CAPCOM ID is the unified account system for Capcom's websites and services, including online features in certain games, and that users can link it to PlayStation, Xbox, Steam, Epic Games and Nintendo accounts. TechRadar reported on October 23, 2026 that CAPCOM ID has more than 10 million users, that no threat actor had claimed responsibility on the dark web, and that Capcom did not discuss the identity of the attackers or the nature of the breach.

Capcom said it has begun notifying affected customers individually and set up dedicated support lines in Japan, the Americas, EMEA and Asia-Oceania. The Japanese toll-free line is 0120-801-271 and operates from 10:00 to 20:00 JST. The company warned users about phishing messages impersonating Capcom and told them not to open links or attachments in suspicious messages.

Analysis

The first judgement is that 11,774,247 is a record count, not a confirmed count of unique victims. SecurityWeek and Malwarebytes both made that distinction. It means the number should be read as exposed account rows in a membership system, not as 11.7 million confirmed password or payment-card thefts. The data types matter more than the raw count: email addresses, login timing, login counts and last-login IP addresses are exactly the material that makes a fake message look real. A scammer who knows when an account was created, when it was last used and how often it has been accessed can write a convincing security alert without holding the password.

What this really means is that the most serious part of this breach is not the 196 changed passwords, even though that is the most visible symptom. The 19 e-Capcom accounts are the sharper concern because the exposed fields include names, addresses, phone numbers, purchase history and inquiry history. That is enough to support targeted fraud, impersonation or follow-on phishing against people who have already shown a commercial relationship with Capcom. The 43 records with date of birth, gender, country or region and nickname add another layer of personal detail, but the e-Capcom group combines identity, contact and transaction context in a way that is more useful to an attacker than an email address alone.

Capcom's response timeline was fast. It detected the activity on October 19, 2026, confirmed the intrusion the same day, set up an internal response headquarters on October 20, 2026, and reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21, 2026. It disclosed publicly on October 22, 2026 and refined the account-level impact on October 23, 2026. The weakness is that the first notice left the e-Capcom impact for the second update, creating a day in which affected customers had to act without the full picture.

The bigger picture here is that account systems are now identity infrastructure, and a breach in a game membership service can become a phishing problem across linked platforms. CAPCOM ID connects to PlayStation, Xbox, Steam, Epic Games and Nintendo accounts, according to Malwarebytes. The stolen metadata does not hand an attacker those platform accounts, and Capcom said credit card information was not included. But it gives an attacker the context to impersonate Capcom support, reference a real login history and push a user toward a fake reset page or a verification-code request.

Why It Matters

This incident matters because Capcom is a large global publisher with a recognizable consumer brand, and recognizable brands are useful cover for phishing. Malwarebytes reported on October 23, 2026 that Capcom is the Japanese developer and publisher behind Resident Evil, Monster Hunter and Street Fighter. Those franchises give any fake Capcom message a plausible hook: a beta invite, an account warning, a store refund or a security check. The leaked account metadata makes such a message more credible because it can include details that a generic phishing email would not know.

The incident also matters because it shows the difference between a password breach and a record breach. Capcom said it has not confirmed compromise of passwords originally set by customers. At the same time, 196 accounts had passwords changed without authorization, and 19 of those accounts had e-Capcom store pages accessed. The narrow but deep impact on those 19 customers is a reminder that aggregate numbers can hide serious individual harm.

TechRadar reported on October 23, 2026 that in November 2020 the Ragnar Locker ransomware group stole about 1 terabyte of data from Capcom and demanded a ransom, and that Capcom later said the entry point was an old VPN device, with the breach affecting 390,000 people. That history does not prove a link to the 2026 incident, and TechRadar noted that no threat actor had claimed responsibility. It does explain why security teams and customers will watch Capcom's recurrence-prevention work closely. A second major security event at the same company raises expectations for stronger controls, clearer communication and faster customer protection.

Next Up

Capcom said its investigation into the scope of the impact is complete and that it will keep monitoring CAPCOM ID and related services. It has promised recurrence-prevention measures and further strengthening of its information-security framework. The immediate tasks are individual notification, support for the 19 e-Capcom customers and continued monitoring for phishing that uses the leaked data. Capcom's support lines remain open, including the Japanese toll-free number 0120-801-271 from 10:00 to 20:00 JST.

Customers should watch for messages that claim to be from Capcom and ask them to open a link, attachment or verification flow. Capcom's notice says not to open links or attachments in suspicious messages. Malwarebytes advised enabling CAPCOM ID two-factor authentication with an authenticator app, checking linked platform accounts, navigating to cid.capcom.com directly rather than following links, and using only the official support channels listed in Capcom's breach notice. Those steps do not undo the breach, but they reduce the chance that a leaked email address and login history become the first step in a larger account takeover.