Lead: Capcom has confirmed a Capcom data breach in which a third party accessed email addresses and login records tied to 11,774,247 Capcom ID accounts worldwide.
What happened in the Capcom data breach
In a press release dated October 22, 2026, Capcom said an outsider gained unauthorized access to customer information linked to Capcom ID, the free unified account used for the company’s web services and required for online play in some of its games, such as Street Fighter 6.
Capcom split the exposed data into three groups. The largest covers 11,774,247 records of email addresses plus system information: when each account was created, when it last logged in, how many times it has logged in, and the IP address used for the most recent login. Within that total, 43 records also exposed date of birth, gender, country or region, and nickname. Finally, the attacker changed the login passwords on 196 accounts without permission; Capcom says it has already reset those passwords.
The company says it has found no sign that passwords originally set by customers were compromised, and that credit card information was not among the affected data. Capcom ID services and its games remain online and playable.
Capcom’s published timeline runs over three days. It spotted suspicious activity on October 19, began blocking it, and confirmed unauthorized access the same day. On October 20 it set up an internal incident response headquarters and briefed its external IT security advisory committee. On October 21 it reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Capcom says it has identified and addressed the attack method, though it has not said publicly what that method was.
Why it matters
Eleven million-plus accounts is a big number for a game publisher’s login service, and it lands just as Capcom’s online footprint is at its widest, with Street Fighter 6 and Monster Hunter titles leaning on persistent accounts. The leaked fields are not the most sensitive kind, but an email address paired with real login history is exactly what a convincing phishing email needs. Capcom itself flags this risk, warning that the data “could be misused to send fraudulent emails or other communications impersonating Capcom.”
It is also not the company’s first security failure. As VGC points out, Capcom disclosed a ransomware attack in November 2020 that exposed personal data belonging to customers and former staff. A second major incident in six years will put pressure on the publisher to show what it has changed, especially with Japan’s privacy regulator now formally involved.
The detail worth watching is the 196 hijacked passwords. Capcom says customer-set passwords were not compromised, yet someone was able to change them on a small number of accounts. How that happened is the part of the story still missing.
What we know vs what is rumored
- Confirmed: 11,774,247 Capcom ID records with email addresses and login metadata were accessed, 43 records also exposed profile details, and 196 accounts had passwords changed and since reset.
- Confirmed: credit card data was not affected, games and Capcom ID remain usable, and police and regulators were notified on October 21.
- Unconfirmed: who carried out the attack, the exact method used, and how the 196 passwords were changed without customer passwords being exposed.
- Note: Anime News Network’s write-up gives the total as 11,777,247; Capcom’s own notice, VGC, and Japan IR’s disclosure summary all list 11,774,247, which is the figure we use.
What happens next
Capcom says it will contact affected customers directly and has opened dedicated support channels, including a Japanese hotline and its regional support inquiry forms. It has promised further disclosures if the investigation turns up new facts, plus measures to prevent a repeat. In the meantime, Capcom ID holders should treat any unexpected “Capcom” email or message with suspicion, avoid clicking links or opening attachments, and change their password if they reused it elsewhere. We will update if Capcom names the attack method or revises its numbers.
Sources: Capcom — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access · VGC — Capcom says a data breach affected more than 11 million Capcom ID accounts · Anime News Network — Capcom Confirms Data Breach of Over 11 Million User Accounts