Eleven million accounts is not a minor figure. A third party gained unauthorized access to Capcom’s CAPCOM ID service, exposing account information tied to 11,774,247 users worldwide, and the most pressing concern now involves what attackers can do with what they took.
The breach is not a payment-card disaster or a confirmed password dump. It is something subtler and, for that reason, worth paying close attention to.
What Capcom Confirmed
Capcom moved quickly to block access and notify authorities, but the scale of the exposure is significant.
Capcom detected suspicious activity on October 19, 2026, blocked the access and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Public disclosure followed on October 22.
Exposed data across the full 11.7 million accounts included registered email addresses, account creation dates, last-login dates, login counts and the IP address associated with the most recent login. A smaller subset of 43 accounts also had profile details exposed, including date of birth, gender, country or region and nickname.
Attackers changed the passwords on 196 accounts without authorization. Capcom said it reset those credentials.
Credit-card data was not part of the breach.
Capcom also confirmed no evidence that original user-set passwords were exposed. The company said CAPCOM ID services remained available after emergency measures were completed, and the incident did not affect players’ ability to access or play games.
The Real Risk and What to Do
Exposed email addresses combined with login metadata give attackers enough context to craft more targeted phishing messages.
The threat here is not a direct account takeover for most users. It is the follow-up: phishing messages that arrive looking like legitimate Capcom communications. Those fake package-delivery texts that flooded phones during the pandemic felt convincing because they referenced real shipping context. Now picture a message that references your account creation date and your last login. That level of detail could make a fake “urgent account notice” more credible.
Capcom advised users not to open suspicious attachments or follow links in unexpected messages. Navigate directly to Capcom’s official regional website or support page; do not use any link arriving in a breach-related email.
Do not share login credentials or payment information in response to unsolicited messages, even ones that appear to come from Capcom’s own support team. Any message asking you to verify your account or confirm credentials warrants a direct visit to the official Capcom site rather than a click on whatever link it contains.
If your Capcom ID password changed without any action on your part, contact Capcom support through official channels. You may be among the 196 accounts directly modified. Using a password unique to your Capcom ID account is a reasonable precaution regardless of whether your account was among those affected.
What Capcom Has Not Said
The method attackers used to gain access has not been publicly disclosed, and the investigation is ongoing.
Capcom has not publicly detailed how the intrusion occurred. According to the company’s disclosure, it identified and began addressing the attack method while its broader investigation continues.
Until Capcom provides more detail, treat every unsolicited message carrying its branding as suspect. If it asks you to log in, verify anything or click through to an account page, go directly to the official Capcom website instead.
