Capcom confirms breach of 11.7 million CAPCOM ID accounts
Capcom confirmed unauthorized access to CAPCOM ID, its online account service, with 11,774,247 records affected worldwide. The company says email addresses and account data were stolen, emergency measures are complete, the attack method was identified and addressed, and services remain available. Passwords changed without authorization on 196 accounts have been reset; users should beware of phishing emails impersonating Capcom.
What happened
Capcom confirmed unauthorized access to CAPCOM ID, its online account service, affecting 11,774,247 records worldwide. Email addresses and account data such as creation date and last login IP were stolen. The company says emergency measures are complete and services remain available.
Why it matters
Millions of exposed email addresses could be used in phishing against Capcom customers, as the company itself warns. For 43 accounts, dates of birth, gender, country/region and nicknames were accessed; passwords on 196 accounts were changed without authorization and have been reset. Capcom says customer-set passwords and credit card data were not compromised.
What to do
Warn employees and users with CAPCOM ID accounts today about fake emails impersonating Capcom or related parties, and avoid suspicious links or attachments. Follow official notices; Capcom is notifying affected customers and has set up a dedicated contact point.
For the technical team
- Affected
- CAPCOM ID (serviço de contas online) · CAPCOM ID accounts worldwide: 11,774,247 records with email and account data (creation date, last login date, login count, last login IP); 43 accounts also with date of birth, gender, country/region and nickname; 196 accounts with unauthorized password changes.
- Exploitation
- Incident confirmed by Capcom with data theft already carried out. Suspicious activity noticed on October 19, 2026, per the company. No CVE, PoC or vulnerability exploitation indicated in the sources.
- Fix
- No software patch. Capcom completed emergency measures, reset passwords on the 196 affected accounts, and says the attack method was identified and addressed; services using CAPCOM ID remain available.
- Vector
- Unauthorized access to CAPCOM ID, Capcom's shared online account service used for online games. Capcom says it identified and addressed the attack method; the sources disclose no technical vector or CVE.
- More details
- Timeline per Capcom and press: suspicious activity noticed October 19, 2026; internal task force set up the following day; incident reported to Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21, 2026. Per Capcom, customer-set passwords and credit card data were not compromised. The company is notifying affected customers and warns against fraudulent emails with suspicious URLs or attachments.
Timeline
Capcom confirms 11.7 million affected accounts and says emergency measures against the attack are complete.
Sources 6 sources
- Notice and Apology Regarding Customer Information Affected Through Unauthorized Access Capcom
- 11 Million Impacted by Capcom Data Breach SecurityWeek
- Capcom confirms data breach affecting 11.7 million accounts BleepingComputer
- 不正アクセスによるお客様情報漏えいのお詫びとお知らせ (PDF) Capcom
- Resident Evil makers Capcom reveal data breach has affected over 11 million Capcom ID accounts, warn against potential phishing emails Rock Paper Shotgun
