Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. An unauthorized third party accessed customer information linked to its online membership service.
This incident, disclosed on October 22, 2026, exposed email addresses and account metadata. A smaller subset of records also included personal profile information and unauthorized password changes.
CAPCOM ID is a unified account system that allows users to access Capcom web services and play certain games online. The company said it successfully implemented emergency containment measures, and there has been no disruption to CAPCOM ID services or players’ ability to access and play its games.
The affected records contained email addresses along with other data that Capcom described as system-specific identifiers. This data included account creation timestamps, last login times, login counts, and the client IP address associated with the most recent login.
Among the total records, 43 also exposed dates of birth, gender, country or region, and nicknames. Capcom identified unauthorized password changes affecting 196 accounts, indicating that the incident involved both account modifications and access to customer information.
Capcom has reset the passwords for those 196 accounts but has not confirmed any compromise of customers’ original login passwords. Unauthorized password changes do not necessarily mean attackers obtained users’ original passwords. Additionally, the affected data did not include credit card information.
Capcom detected suspicious activity on October 19 and immediately began blocking unauthorized access while investigating the incident’s cause and scope. Investigators confirmed the intrusion on the same day, prompting emergency measures to address the attack.
On October 20, Capcom established an internal incident response team. Their investigation confirmed that customer information had been exposed and that unauthorized password changes had occurred. The company also notified its external advisory body, the Information Technology Security Oversight Committee.
On October 21, Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Monitoring and investigation efforts are ongoing as the company assesses the breach’s full impact.
Capcom warned that the exposed information could be used to support phishing emails or other fraudulent communications impersonating the company or related organizations. Customers are advised to avoid opening attachments or following links in suspicious messages. Registered email addresses can still be used.
Although Capcom claims to have identified and addressed the attack method, the notice does not disclose how the initial access occurred, whether specific vulnerabilities or malware were involved, or who the attackers were.
The company will contact affected customers individually and has established regional support channels. Additionally, it has committed to conducting a further investigation, implementing measures to prevent future incidents, enhancing information security controls, and providing additional public updates as new relevant information becomes available.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
