> ## Content Index
> Fetch the complete content index at: https://bullquill.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Capcom data breach exposes 11.7 million CAPCOM ID records
- URL: https://bullquill.com/capcom-id-data-breach-11-million-accounts/
- Published: 2026-10-23T16:14:09.000Z
- Updated: 2026-10-23T16:29:07.000Z
- Description: Emails, last-login IP addresses and account dates leaked from 11,774,247 CAPCOM ID records. Capcom says no payment data or customer-set passwords were confirmed exposed, but players should expect phishing.
- Author: Rowan Ashby
- Tags: Games, Capcom, CAPCOM ID, Data Breach, Japan, #lang-en, #tr-capcom-id-data-breach-11-million-accounts

## Key takeaways

- Capcom says an unauthorized third party accessed customer data tied to CAPCOM ID, exposing 11,774,247 records worldwide.
- Every affected record includes an email address plus account system data: creation date, last login time, login count, and the IP address used at the last login.
- For 43 of those records, date of birth, gender, country or region, and nickname were also exposed.
- Passwords on 196 accounts were changed without authorization; Capcom has reset them. The company says it has not confirmed any leak of customer-set passwords, and credit card data was not included.
- Capcom detected the intrusion on October 19, 2026, and reported it to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21.

## Capcom data breach: what the company confirmed

The Capcom data breach exposed email addresses and login metadata from 11,774,247 CAPCOM ID records, the Japanese publisher said in a notice dated October 22, 2026\. Passwords set by users were not confirmed as leaked, and no payment card data was involved.

CAPCOM ID is the shared account players use to sign in to Capcom's web services and some of its online games. In its English-language notice, Capcom said a third party gained unauthorized access to customer information linked to the service. The figures below are as of October 22, according to the company.

BleepingComputer and Help Net Security, which both reported on the notice, said Capcom has not explained how the attackers got in. Help Net Security reported that no group had claimed responsibility at the time of its report on October 23\. BleepingComputer noted that the date the intrusion began is still unclear.

## What data was exposed in the CAPCOM ID breach

Capcom split the affected information into three groups. The larger groups contain the smaller ones: the 43 records with profile details and the 196 hijacked accounts are both part of the 11.77 million total.

| Group                                           | Number affected        | Data involved                                                                                                              |
| ----------------------------------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| All affected CAPCOM ID records                  | 11,774,247 (worldwide) | Email address; account creation date and time; last login date and time; number of logins; client IP address at last login |
| Records with extra profile data                 | 43                     | Date of birth, gender, country or region, nickname (in addition to the above)                                              |
| Accounts with passwords changed by the intruder | 196                    | Login password changed without authorization; Capcom has since reset these passwords                                       |
| Not affected, per Capcom                        | —                      | Credit card information; no confirmed leak of customer-set passwords                                                       |

Source: Capcom notice, October 22, 2026 (figures as of that date).

On its own, an email address combined with an IP address and login history is not enough to sign in to an account. It is, however, useful to scammers. Knowing that an address belongs to an active Capcom player, and roughly when that person last logged in, makes a fake "Capcom security alert" look far more convincing.

## Timeline: from detection to police report

Capcom's notice sets out a short, three-day response window.

- **October 19, 2026:** Capcom found traces of suspicious activity, blocked the access, and confirmed unauthorized access the same day. It then began identifying the attack method.
- **October 20:** The company set up an internal incident response headquarters, confirmed that customer data had leaked and that some passwords had been changed, and briefed its external Information Technology Security Oversight Committee.
- **October 21:** Capcom reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission (PPC), the national data protection regulator.
- **October 22:** Capcom published its apology and notice in Japanese and English.

According to Help Net Security's summary of the notice, Capcom says its emergency response is complete and that it has identified and addressed the attack method. The investigation continues, and Capcom says it will post further information on its website if more must be disclosed.

## Is my Capcom account affected?

Capcom has not released a public lookup tool. The company says it will contact affected customers, and it has set up support channels by region:

- **Japan:** a dedicated toll-free line, 0120-801-271, open 10:00 a.m. to 8:00 p.m. JST.
- **North, Central and South America:** the Capcom USA customer support inquiry form on capcom-support.com.
- **Europe, the Middle East and Africa:** the Capcom Europe customer support inquiry form on capcom-support.com.
- **Asia (excluding Japan) and Oceania:** the email address listed in Capcom's notice.

Because 11.77 million records were involved, anyone who has registered a CAPCOM ID should assume their email address may be on the list. Capcom says CAPCOM ID services and its games remain available, play is not affected, and registered email addresses can still be used.

Be careful with any message that claims to tell you whether you were affected. Capcom's own notice warns that the leaked data could be used in fraudulent emails that impersonate Capcom or related parties.

## What players should do now

Capcom's main advice is about phishing. It asks customers who receive suspicious emails or messages to "refrain from accessing any URLs contained therein or opening any attached files." The steps below follow that advice and add standard account-security practice.

1. **Treat unexpected "Capcom" emails as suspect.** Do not click links or open attachments in messages about the breach, refunds, free items, or "account verification." Type the Capcom or CAPCOM ID address into your browser yourself instead.
2. **Check the sender and the link destination.** Phishing emails often use look-alike domains. Hover over or long-press a link to see where it really goes before tapping it.
3. **Change reused passwords.** Capcom says it has not confirmed that customer-set passwords leaked. However, if your CAPCOM ID password is also used on other sites, change it on those sites and give each account its own unique password. A password manager makes this easier.
4. **Turn on two-step verification where you can.** Capcom's notice does not mention two-factor authentication for CAPCOM ID. Enable it on the email account linked to your CAPCOM ID and on the platform accounts you use to play, such as console and PC store accounts. Your email inbox is the key to resetting most other passwords. Our guide on [how to set up passkeys](https://bullquill.com/how-to-set-up-passkeys/) covers an even stronger option where it is supported.
5. **If you cannot log in, contact support directly.** The 196 hijacked accounts have been reset by Capcom. If your password suddenly stops working, use your region's official support channel listed above rather than any link sent to you.
6. **Never share one-time codes.** Capcom or any genuine support agent will not ask you for a verification code over email or chat.

## How this compares with Capcom's 2020 cyberattack

This is not Capcom's first major security incident. In November 2020, the company disclosed a ransomware attack on its internal network. In April 2021, it said the attackers had entered through an old VPN device, BleepingComputer recalls.

The 2026 incident is different in kind. It concerns the consumer account system used by players worldwide rather than corporate networks. Measured by record count, it is far larger. The data exposed per person is narrower, however: for almost all of the 11.77 million records it is limited to an email address and login metadata.

Recent breach disclosures follow a similar pattern, with large record counts but limited fields per person. See our coverage of the [Quest Diagnostics Quanum breach](https://bullquill.com/quest-diagnostics-quanum-breach-patient-records/) and the [State Bank of India cyberattack](https://bullquill.com/state-bank-of-india-cyberattack-what-we-know/). The [PHP emergency security patches](https://bullquill.com/php-emergency-security-patches-what-to-do/) show how quickly one weak point can spread across many services.

## What it means

For most players, the immediate risk is targeted phishing, not direct account takeover. Attackers now hold a list of millions of verified gamer email addresses with recent login dates. That lets them send convincing fake Capcom messages, especially around big releases and sales, when players expect emails from the publisher.

For Capcom, the incident falls under Japan's personal information rules, which is why the company reported it to the Personal Information Protection Commission within two days of detection. Capcom has not said whether regulators outside Japan have been notified. Key questions remain open:

- How did the intruder get in?
- When did the access begin?
- Why did only 43 records include profile details?

Bullquill will update this article if Capcom publishes further findings.

## Frequently asked questions

### How many accounts were affected by the Capcom data breach?

Capcom says 11,774,247 CAPCOM ID records worldwide had their email address and account system data exposed, as of October 22, 2026\. Of these, 43 also exposed date of birth, gender, country or region and nickname, and 196 accounts had their passwords changed by the intruder.

### Were CAPCOM ID passwords or credit card details leaked?

Capcom says credit card information was not included and that it has not confirmed any leak of passwords set by customers. The 196 accounts whose passwords were changed without authorization have been reset by Capcom.

### How do I know if my CAPCOM ID was affected?

Capcom has not published a lookup tool. It says it will contact affected customers and has set up regional support channels, including a toll-free line in Japan and inquiry forms on capcom-support.com for the Americas and for Europe, the Middle East and Africa.

### What should Capcom players do after the breach?

Be wary of emails or messages claiming to be from Capcom and do not open their links or attachments, change any password you reuse elsewhere, and turn on two-step verification for the email account linked to your CAPCOM ID.

## Sources

- [Capcom: Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (English, October 22, 2026)](https://www.capcom.co.jp/ir/english/news/html/e261022.html?ref=bullquill.com)
- [Capcom: 不正アクセスによるお客様情報漏えいのお詫びとお知らせ (Japanese original, October 22, 2026)](https://www.capcom.co.jp/ir/news/html/261022.html?ref=bullquill.com)
- [BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts](https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/?ref=bullquill.com)
- [Help Net Security: CAPCOM ID data breach, 11 million records exposed (October 23, 2026)](https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/?ref=bullquill.com)
- [PC Gamer: Capcom confirms a data breach has affected over 11 million people](https://www.pcgamer.com/hardware/capcom-confirms-a-data-breach-has-affected-over-11-million-people-with-emails-ip-addresses-and-birthdays-caught-up-in-the-mix/?ref=bullquill.com)