Japanese game publisher Capcom says an unauthorized party accessed 11,774,247 CAPCOM ID account records worldwide. The exposed data includes email addresses and login metadata, which makes convincing phishing messages more likely for anyone with a CAPCOM ID.
What happened
Capcom says it detected suspicious activity on October 19, 2026 and confirmed an intrusion the same day. On October 20 it set up an internal incident response headquarters and informed an external advisory body. On October 21 it reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission, according to reporting by Help Net Security and GBHackers based on Capcom’s notice, which was published on October 22 and updated on October 23.
For every affected record, the data includes the email address plus account system data: account creation date, last login time, number of logins and the IP address of the most recent sign-in. For 43 records, Capcom says date of birth, gender, country or region and nickname were also involved. Capcom says payment card information was not affected, and that CAPCOM ID services and games remain available.
Capcom also reports that 196 accounts had their passwords changed without authorization. It has reset those passwords. The company says it has not confirmed that customers’ own passwords were compromised.
Who is affected
Anyone with a CAPCOM ID, the account used across Capcom’s online services and games, could be among the 11.77 million records. Capcom says it plans to notify affected customers directly and has opened regional support channels, including a toll-free line in Japan and online contact forms for the Americas and EMEA.
What to do
The following steps are our analysis rather than Capcom’s instructions, except for the phishing warning, which Capcom itself issued.
- Treat any email, text or message claiming to come from Capcom with suspicion, and avoid opening links or attachments in unexpected ones. Capcom has warned about this.
- Change your CAPCOM ID password and set a unique one, especially if you reuse it elsewhere. Because attackers changed some passwords, a sign-in failure you did not expect is worth acting on.
- Turn on any additional sign-in protection the service offers, and change the password on any other account that shares your CAPCOM ID email and password.
- Go to Capcom’s official site directly rather than through a link in a message when checking whether you are affected.
What we still do not know
Capcom has not said how the attackers got in, only that it has addressed the attack method. It has not named the attackers, and no group had claimed responsibility in the reports we reviewed. It has not explained how the 196 password changes were made, whether the intrusion is fully contained, or whether further data will be found, since the investigation is ongoing. Capcom also suffered a ransomware attack in 2020, but nothing published so far links the two incidents.
Sources: Help Net Security (Oct. 23, 2026); GBHackers (Oct. 2026); GamingBible (Oct. 23, 2026), each reporting Capcom’s October 22 and 23, 2026 notices.
Leave a Reply