Capcom ID Breach: 11.7 Million Accounts Exposed — What Affected Users Should Do

In brief

• Capcom confirmed a CAPCOM ID breach affecting 11,774,247 accounts. Your password and card details were not leaked, but your email was — here is what to do next.
• Attackers accessed email addresses plus account creation dates and times, last login timestamps, login counts, and the IP address used at last login.
• A smaller group was hit harder: 43 accounts also had birth date, gender, country or region, and nickname exposed, and 196 accounts had their passwords changed without authorization.
• In an October 23 update, Capcom said 19 of those 196 accounts — all in Japan — were used to view e-Capcom store pages, including names, addresses, phone numbers, and purchase history.
• If you have a Capcom account, change any reused password, check your account for changes you did not make, and treat unexpected Capcom emails as suspicious until you verify them directly on Capcom’s own site.

Capcom has confirmed one of the largest gaming account breaches of the year: unauthorized access to its CAPCOM ID system exposed data tied to 11,774,247 accounts worldwide. The short version for anyone with a Capcom account is reassuring on two points and worrying on one. Capcom says the passwords players chose were not leaked, and credit card information was not included. But email addresses were — and a verified list of gamer email addresses is exactly what phishing campaigns are built on. This guide sticks to what Capcom has actually confirmed, explains what the October 23 update changed, and gives you a concrete checklist to work through.

What happened in the Capcom ID breach?

Capcom detected signs of suspected unauthorized access to CAPCOM ID on October 19, 2026, blocked the access the same day, and confirmed the intrusion. CAPCOM ID is the account players use for Capcom’s web services and for online play in some of its games, including major series such as Resident Evil, Monster Hunter, and Street Fighter. On October 20, Capcom set up a response headquarters, confirmed that customer data had leaked and that some passwords had been changed, and reported to its external IT Security Oversight Committee. On October 21, it reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. It then disclosed the breach publicly on October 22, 2026, in Japanese and English.

The speed of that timeline matters. Detection, blocking, and confirmation all happened on October 19, and public disclosure followed three days later with exact figures rather than vague estimates. Capcom also set up support desks for Japan, the Americas, Europe, the Middle East and Africa, and Asia and Oceania, which underlines that this was a global incident, not a Japan-only one. The 11.77 million affected accounts are spread worldwide, even though the most serious follow-on access disclosed so far — the e-Capcom store viewing — involved accounts in Japan only.

Crucially, Capcom says its games and CAPCOM ID services remain available. Players can keep using the email address registered with CAPCOM ID to play titles such as Street Fighter 6 without disruption, according to the company’s disclosure. That is worth stating plainly, because breach news often triggers a rush of rumors about shutdowns or lost access. Nothing Capcom has said suggests your games or your account are gone. What has changed is the risk around your inbox: assume that an attacker now knows your email address belongs to an active Capcom player, and act accordingly.

What data was exposed — and what was not?

For all 11,774,247 affected accounts, the exposed data was: email address, account creation date and time, last login timestamp, number of logins, and the IP address used at the last login. That is a narrow set compared with many breaches, which often include names, home addresses, and payment details for everyone affected. Capcom appears to have held relatively little personal data for most CAPCOM ID accounts, and that limited what attackers could take at scale. It does not make the leak harmless, but it does shape the risk: the main danger for most people is targeted phishing, not identity theft built on a full personal profile.

For 43 accounts, attackers also accessed birth date, gender, country or region, and nickname. Those 43 people face a slightly higher risk, because a birth date combined with an email address is a useful ingredient for account-recovery scams and impersonation attempts. If you are contacted by Capcom directly about your account, take that message seriously and follow its instructions through Capcom’s official channels, not through links in the message itself.

For 196 accounts, attackers changed the password without authorization. Capcom has reset those passwords and says it is contacting affected customers. It is important to understand what this does and does not mean. Capcom says it has not confirmed any leak of the passwords that players set themselves. In other words, the company is not saying attackers stole a database of passwords and can now log in everywhere. It is saying attackers managed to change the passwords on 196 accounts, then reset them back. How they were able to change those passwords has not been explained, and that gap is one of the biggest unanswered questions in this incident.

What was not exposed, according to Capcom, is just as important. User-chosen passwords were not leaked, and credit card information was not included in the breach. If you see a message claiming your Capcom payment card has been compromised in this incident, that contradicts Capcom’s own disclosure and should be treated as suspicious. Likewise, no one should pay for a supposed “breach protection” service on the back of this news without checking it independently first. The pattern of large breaches being followed by scam messages is well established, and this one is no exception: Capcom itself has warned players not to click suspicious links or open fraudulent emails impersonating the company.

What happened to the 19 hijacked e-Capcom store accounts?

On October 23, 2026, Capcom published a follow-up that sharpened the picture considerably. Attackers used 19 of the 196 accounts whose passwords had been changed to log in to My Page on e-Capcom, Capcom’s online store, which also uses CAPCOM ID. All 19 accounts were in Japan. Once inside those store pages, the attackers could view a much more personal set of details: name, including the phonetic reading of the name, phone number, postal code and address, gender and date of birth, purchase history, the account’s inquiry history with e-Capcom, and the member’s address book, which can hold other people’s delivery addresses.

That last detail deserves attention even if you do not live in Japan. An address book can contain delivery addresses belonging to other people — friends or family members who never held a CAPCOM ID themselves. It is a reminder of how a single compromised account can expose people beyond the account holder. Capcom says it will contact the 19 customers directly, that no card data was involved in this store access, and that it found no information compromised through the other hijacked accounts. It also says its investigation into the scope of the incident is complete, and that it will keep monitoring CAPCOM ID.

For readers outside Japan, the October 23 update should not be read as “this part does not affect me, so I can ignore it.” It is proof of a principle that applies everywhere: a shared account system means one way in can reach more than one service. The attackers did not stop at changing passwords; they used the hijacked accounts to log in as the customer to another Capcom service and read what was stored there. That is why the advice in this guide covers all of your linked Capcom services, not just the CAPCOM ID login page, and why checking for changes across your account — a different email address, a new linked platform, an unfamiliar address — matters more than simply changing one password and moving on.

Was my password or credit card leaked?

Based on everything Capcom has confirmed so far, the answer is no on both counts — with one important caveat. Capcom says it has not confirmed any compromise of the login passwords customers chose, and that credit card information was not included. If your only connection to Capcom is a CAPCOM ID account, there is no confirmed evidence that your password or your card details are in attackers’ hands because of this incident.

The caveat is about password reuse, and it is the single most useful thing to take away from this breach. If you used your Capcom password on any other site or service, change it on those other services now, regardless of what Capcom says about its own passwords. Breach disclosures describe one incident; reused passwords turn one incident into many. The same logic applies in reverse: if you reused another site’s password for Capcom, change your Capcom password too, because a leak elsewhere could put this account at risk in the future. A password manager makes this practical — one unique password per service, so a single breach can never cascade across your accounts.

It is also worth being precise about what “not leaked” means here. Capcom has said it has not confirmed a leak of user-chosen passwords, which is slightly different from a categorical guarantee that no password data was ever touched. The company is still monitoring CAPCOM ID and has said it will publish further facts if it finds any. Treat the current position as reassuring but not final: keep an eye on further Capcom updates, and do not assume that a statement made on October 22 or 23 covers anything discovered later. If you are one of the 196 account holders whose password was changed, Capcom has reset it and should contact you directly — if you cannot log in, go through Capcom’s official account recovery route rather than trusting a recovery link sent by email.

What should I do now if I have a Capcom account?

Work through this checklist in order. It takes a few minutes for most people and covers the realistic risks from this breach rather than the imagined ones.

First, sign in to your CAPCOM ID account directly — type Capcom’s address yourself or use a bookmark you already trust, never a link from an email about the breach. Check that your registered email address, nickname, and any linked platforms are ones you recognize. Look for changes you did not make. If anything looks wrong, or you cannot sign in at all, contact Capcom through its official support channels right away.

Second, change your Capcom password if you reuse it anywhere else, and change it on those other services too. Even though Capcom says passwords were not leaked, a fresh, unique password removes the reuse risk entirely and costs nothing. While you are in your account settings, turn on any additional sign-in verification Capcom offers for your account, and review which devices or platforms are linked to it. Removing an old or unfamiliar link is a quick win.

Third, treat your email inbox as the front line for the next few months. Expect phishing emails that pretend to be from Capcom and reference this breach. Expect some of them to look convincing, because the attackers know your email address belongs to a Capcom player and may know roughly when you last logged in. Delete messages that pressure you to act urgently, and never enter your Capcom password on a page you reached through an email link.

Fourth, watch for account notices from Capcom itself. Capcom says it is notifying affected customers and has opened dedicated support channels. A genuine notice may ask you to sign in or take action, but do that by going to Capcom’s site directly, not by following the message’s links. The same rule applies to phone calls or text messages claiming to be about your Capcom account: hang up and contact Capcom through a number or channel you find yourself.

Fifth, if you are in Japan and use the e-Capcom store, check your store account too — your saved addresses, purchase history, and inquiry history. If you shared a delivery address with someone else through an address book, let that person know their address may have been visible in someone else’s account, even though Capcom says only 19 store accounts were accessed. Outside Japan, the store-access finding is still a useful warning: review saved addresses and payment methods on any Capcom service you use, and remove anything you no longer need stored there.

This kind of account hygiene is useful far beyond a single incident. Readers following the recent ransomware advisory affecting hundreds of victims will recognize the same pattern: attackers reuse exposed details long after the headlines fade. The same applies to the recent wave of smaller, more frequent hacks, where stolen contact details become the raw material for the next scam. Breach news moves fast; the scams built on it move slowly and quietly, which is why the checklist matters more than the headline.

How do I spot phishing emails using my leaked email address?

Phishing built on this breach will probably not look like the generic spam you are used to. A convincing fake might mention Capcom by name, reference a “suspicious login” or “account recovery” step, and arrive soon after the breach news, when you are expecting to hear from Capcom. Some fakes may even mention your last login in vague terms, because login timestamps were part of the exposed data. A message does not become genuine just because it knows something about you — attackers can know your email address and still be lying about everything else.

There are reliable tells. First, check where links actually go before you click: hover over them on a computer, or press and hold on a phone, and look at the destination. A genuine Capcom message should lead to a Capcom domain you recognize, not a lookalike address with extra words, hyphens, or misspellings. Second, be suspicious of urgency. “Your account will be closed in 24 hours” and “verify now or lose your games” are pressure tactics, not normal customer-service language. Third, never open unexpected attachments from a supposed Capcom message, and never type your password, a verification code, or payment details into a page that an email sent you to. If a message claims there is a problem with your account, close it and check your account directly on Capcom’s site.

The same caution applies to messages on social media and in gaming communities. Fake support accounts often appear after a big breach, offering to “check” whether your account was affected if you share your username or email address. Do not hand those details to strangers: you already know the answer in general terms — if you hold a CAPCOM ID account, assume your email address was in the affected set unless Capcom tells you otherwise — and no third party needs your credentials to confirm that. For a broader look at how scam messages are evolving, see Chrome’s new scam warnings and the clickfix tricks they target, which cover the same social-engineering tactics in a different setting.

Do I need to do anything if I only play Capcom games?

Yes, but probably less than you fear. If you play Capcom games online through an account that uses CAPCOM ID, you are in the affected population in the broad sense: your email address and login records may have been exposed even if nothing else about you was. The steps above — checking your account, fixing reused passwords, and raising your guard against phishing — still apply. What you do not need to do is panic about your games disappearing or your save data being wiped; Capcom says games and CAPCOM ID services are unaffected, and nothing in the disclosure suggests otherwise.

If you play Capcom games without ever creating a CAPCOM ID account — for example, playing offline or through a platform account alone — this breach does not directly expose your data through Capcom’s system, because there is no CAPCOM ID record to expose. Even then, the phishing advice is worth keeping in mind: scammers do not check whether you actually hold an account before they send a fake Capcom email to a purchased or scraped address list. The habit of going to a company’s site directly, rather than clicking email links, protects you whether or not you were in this particular breach.

Parents and households should also check accounts held by younger players. A child’s CAPCOM ID account carries the same email-and-login-record exposure as an adult’s, and a child is more likely to click a convincing fake message. If a family member’s account uses a parent’s email address, that inbox is now a more attractive phishing target too. A quick household check — who holds a Capcom account, which email address is on it, and whether that password is reused anywhere — is a sensible weekend task after news like this.

What is Capcom doing next, and what is still unknown?

Capcom says it has identified and addressed the attack method involved, that it will implement measures to prevent a recurrence, and that it will further strengthen its information security framework. It has apologized to affected users, is contacting them individually, and says it will keep monitoring CAPCOM ID. It has also said its investigation into the scope of the incident is complete, following the October 23 update on the 19 store accounts. Those are concrete commitments, and they are more specific than the vague “we take security seriously” language that often follows a breach.

What Capcom has not said is equally important, and this article will not fill those gaps with guesses. Capcom has not said how attackers got into CAPCOM ID. It has not explained how the passwords of 196 accounts were changed, or why those accounts were chosen. It has not said whether the data was copied out in bulk or accessed in some other way, where the affected players are located beyond the worldwide total, or whether regulators outside Japan have been notified. It has also not said whether CAPCOM ID will add or require stronger login protection in response. Until Capcom answers those questions, any claim about the attack technique is speculation, and readers should treat it as such.

That uncertainty is the reason to act on what is known rather than wait for a complete explanation. You do not need to know how attackers entered the system to change a reused password, check your account, or delete a suspicious email. And if Capcom publishes a further update — a new figure, a new affected service, or a change to its advice — the right response is the same one as now: verify it on Capcom’s own site, then adjust. We will update this guide if Capcom releases material new facts about the breach or its advice to users.

The bottom line is straightforward. This was a very large breach in terms of account numbers and a narrow one in terms of data per account — except for the 196 people whose passwords were changed and the 19 whose store pages were opened. For most Capcom players, the real risk is not a stolen password or a stolen card, but a well-targeted phishing email arriving in the weeks ahead. Change reused passwords, check your account directly, and give every unexpected Capcom message a second look before you click. That is the whole job, and it is enough.

Sources

• Japan Cyber Watch — “Capcom Data Breach: CAPCOM ID Data on 11.77 Million Accounts Worldwide Accessed, Passwords Changed on 196” — https://japancyberwatch.com/articles/capcom-id-breach-11-million-accounts-2026
• Beebom — “Capcom Suffers Major Data Breach Affecting Over 11.7 Million Users Worldwide” — https://www.beebom.com/capcom-suffers-major-data-breach-users-affected-worldwide/
• SiliconReport — “Capcom confirms data breach affecting 11.7 million people” (October 24, 2026) — https://www.siliconreport.com/capcom-confirms-data-breach-affecting-11-7-million-people
• Pixel Herald — “Capcom ID Data Breach: 11.7 Million Records Exposed” (October 22, 2026, updated October 23, 2026) — https://pixelherald.com/was-capcom-id-hacked-breach-hits-11-7-million-accounts/

Related: Quest Diagnostics Breach: Patient Records Accessed, and Almost Nothing Quantified — the same pattern in reverse: a short disclosure that confirms access but quantifies nothing, and why patients should not wait for a personal notice.