Capcom
TrendingNew
Capcom data breach: 11.77 million CAPCOM ID records exposed, and passwords changed on 196 accounts
Capcom says a third party gained unauthorized access to customer information linked to CAPCOM ID, its free account service for Capcom websites and online play, exposing 11,774,247 records worldwide, according to the company's notice of Oct. 22, 2026. The records hold email addresses and login data: when each account was created, when it last signed in, how many times it signed in and the IP address of the last login. The attacker changed the passwords of 196 accounts, and on Oct. 23 Capcom said 19 of those, all in Japan, had their e-Capcom store details viewed, including names, addresses and phone numbers. Credit card information wasn't affected, and every Capcom game stays playable.
- PC
- PS5
- Xbox Series X|S
- Switch 2
Capcom’s account service exposed 11.77 million records, and an attacker changed the passwords of 196 accounts. Here’s what leaked, who’s affected and what CAPCOM ID users should do.
Was Capcom hacked?
Yes. Capcom confirmed on Oct. 22, 2026, that a third party gained unauthorized access to customer information linked to CAPCOM ID, the free account players use to sign in to Capcom websites and to play certain Capcom games online. The notice, signed by President and COO Haruhiro Tsujimoto, says Capcom has identified and addressed the attack method. Capcom hasn’t said who was behind the attack or how the attacker got in.
What leaked in the Capcom data breach
| Data | Records | Where |
|---|---|---|
| Email address, account creation and last login date and time, number of logins, last login IP address | 11,774,247 | Worldwide |
| Date of birth, gender, country or region, nickname | 43 | Within the 11.77 million |
| Password changed by the attacker | 196 accounts | Within the 11.77 million |
| e-Capcom name, phonetic name, phone number, postal code, address, gender, date of birth, purchase and inquiry history, address book | 19 | Japan |
The 11.77 million figure counts records, the unit Capcom uses, and Capcom hasn’t turned it into a number of players. For almost every record, the exposed data is an email address plus four pieces of login data. Capcom says it hasn’t confirmed any compromise of passwords that players set themselves, and credit card information wasn’t affected.
On Oct. 23, Capcom said the attacker opened the pages of 19 of the 196 accounts with changed passwords on e-Capcom, its online store in Japan, and found nothing else compromised through the other accounts.
Capcom breach timeline
| Date | What happened |
|---|---|
| Oct. 19 | Capcom detects suspicious access to CAPCOM ID, starts blocking it and confirms the breach the same day |
| Oct. 20 | Capcom sets up an incident response headquarters, confirms customer information was accessed and passwords changed on some accounts, and reports to its outside IT security oversight committee |
| Oct. 21 | Capcom reports the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission |
| Oct. 22 | Capcom publishes its notice and apology with the 11,774,247 figure |
| Oct. 23 | Capcom confirms 19 e-Capcom records in Japan and says the investigation into the scope is complete |
Capcom keeps monitoring CAPCOM ID and related services and is working on measures to prevent a repeat.
What CAPCOM ID users should do
- Watch for phishing. Capcom warns that the exposed data can be used in fake emails, texts and phone calls posing as Capcom. Skip links and attachments in unexpected messages about your account.
- Turn on two-factor authentication. CAPCOM ID supports it from the Account page with an authenticator app, and Capcom recommends Google Authenticator or Microsoft Authenticator. Before switching phones, turn it off on the old device and set it up again on the new one.
- Change reused passwords. Capcom found no leak of player-set passwords, but an exposed email address makes any password shared across sites a target.
- Check linked accounts. CAPCOM ID links to PlayStation, Xbox network, Steam and Epic Games accounts and pairs with Nintendo game accounts, so review the security settings there too.
Capcom says it will contact affected customers. A message that asks for a password or payment details is a reason to sign in through the official CAPCOM ID site instead of the link.
Which games and sites use CAPCOM ID. CAPCOM ID is needed to play certain Capcom games online, and it signs players in to the Resident Evil Portal, Buckler’s Boot Camp for Street Fighter 6, Capcom Town and the Monster Hunter Puzzles: Felyne Isles app. Capcom says the breach doesn’t affect access to any of its games. Street Fighter 6 sells for $15.99 on Switch 2 until Nov. 4, as our Street Fighter 6 Switch 2 page explains, and Monster Hunter Wilds arrives on Switch 2 on Dec. 4, as our Monster Hunter Wilds Switch 2 page shows.
Capcom’s 2020 ransomware attack. Capcom has been breached before. In October 2020, attackers got into Capcom’s network through an old backup VPN device at its North American subsidiary, and on Nov. 1 and 2, 2020, ransomware from a group calling itself Ragnar Locker encrypted files on devices in its US and Japanese offices. Capcom’s final report on April 13, 2021, confirmed that data of 15,649 people was compromised, and none of it included credit card information. The 2026 breach covers far more records, 11.77 million, but almost all of them hold only an email address and login data.
Capcom reports its results for April to September on Oct. 27, its first scheduled report since the breach, as our Capcom earnings date page explains.
This page is updated as soon as Capcom posts new details on the CAPCOM ID breach.
Official images
2
FAQ
Was Capcom hacked?
Yes. Capcom confirmed on Oct. 22, 2026, that a third party accessed customer information linked to CAPCOM ID. Capcom detected the access on Oct. 19, immediately began blocking it and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on Oct. 21.
How many people are affected by the Capcom data breach?
11,774,247 records worldwide, according to Capcom. Each record holds an email address and login data. Capcom counts affected records and hasn’t published a separate number of players.
What information was leaked in the Capcom breach?
Email addresses, the date and time each account was created and last signed in, the number of logins and the IP address of the last login. 43 of the records also included date of birth, gender, country or region and nickname.
Were CAPCOM ID passwords leaked?
Capcom says it hasn’t confirmed any compromise of passwords that players set themselves. The attacker changed the passwords of 196 accounts, and Capcom has reset all of them.
Was credit card information stolen in the Capcom breach?
Capcom says credit card information wasn’t among the affected data, in both its Oct. 22 notice and its Oct. 23 update.
Should I change my CAPCOM ID password?
Yes, and turn on two-factor authentication. Capcom reset the 196 accounts the attacker changed and hasn’t required a reset for anyone else, but an exposed email address makes a reused password the easiest way in. Change the same password on every other site that uses it.
How do I turn on two-factor authentication for CAPCOM ID?
Sign in to CAPCOM ID, open the Account page and set up two-factor authentication with an authenticator app on a phone or tablet. Capcom recommends Google Authenticator or Microsoft Authenticator.
Can I still play Capcom games after the breach?
Yes. Capcom says the incident doesn’t affect access to any of its games, and every service that uses CAPCOM ID, including online play, stays available.
Will Capcom contact affected players?
Yes. Capcom says it will notify affected customers. It runs a dedicated support line in Japan, an inquiry form through Capcom USA and Capcom Europe customer support for the Americas and for Europe, the Middle East and Africa, and a support email for Asia and Oceania.
Has Capcom been hacked before?
Yes. In October 2020, attackers got into Capcom’s network through an old backup VPN device at its North American subsidiary, and in November they set off ransomware from a group calling itself Ragnar Locker. Capcom’s final report on April 13, 2021, confirmed that data of 15,649 people was compromised.
Pop quiz
1 questions from this story.
How many CAPCOM ID accounts had their passwords changed by the attacker?
The attacker changed the passwords of 196 accounts. 43 records also exposed birth dates and nicknames, and 19 of the 196 accounts had their e-Capcom store details viewed.
Your call
What are you doing after the CAPCOM ID breach?
