Short answer
Capcom confirmed that a third party accessed 11,774,247 CAPCOM ID records after it detected suspicious activity on October 19, 2026. The records mostly hold email addresses and login metadata. Capcom says card data was not affected and found no evidence customer passwords were stolen.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Capcom |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Video games |
| Country | Japan |
| Detected | 2026-10-19 |
| Disclosed | 2026-10-22 |
| People or records affected | 11,774,247 CAPCOM ID records worldwide |
What data was exposed
- Email addresses (all affected records)
- Account creation date, last login time, number of logins and the IP address of the most recent sign-in
- Date of birth, gender, country or region and nickname (43 records only)
What happened
Capcom, the Japanese game publisher, said a third party gained unauthorized access to CAPCOM ID, the shared account used to sign in to its web services and some online games. According to Help Net Security, the company detected suspicious activity on October 19, 2026 and confirmed the intrusion that day. In total, 11,774,247 records were accessed.
Timeline
- October 19: Capcom detects suspicious activity and begins blocking access.
- October 20: It sets up an internal incident response headquarters and informs an external IT security oversight committee.
- October 21: It reports the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
- October 22: Capcom publishes an alert, per BleepingComputer.
What Capcom says was and was not exposed
Every affected record included an email address and account system data. A small subset of 43 records also held a date of birth, gender, region and nickname. Capcom told customers it found no evidence that passwords set by customers were compromised, but attackers did change passwords on 196 accounts without authorization. Capcom has reset those. Payment card data was not affected, the company says, and game access was not disrupted.
Because the attack method has not been described publicly, we cannot say how the intruders got in. BleepingComputer notes that Capcom says it identified the intrusion method and put protections in place, but it has not shared details.
How Capcom is responding
Capcom plans to notify affected customers in stages because of the volume of accounts, and has opened a toll-free line in Japan and online forms for the Americas and Europe, the Middle East and Africa. It advises players to be careful with emails that appear to come from Capcom and not to open links or attachments in suspicious messages.
What is still unknown
No group has claimed responsibility. It is not clear whether the data is being sold or posted. Capcom says it will publish further updates if needed. This follows a November 2020 ransomware attack on the company, which BleepingComputer and Help Net Security both mention as background.
Why the scam risk is real
An email list tied to a game account is a ready-made phishing target. Scammers do not need passwords to send a convincing “your Capcom account is at risk” message. Our guide to phishing messages shows how to check a sender and a link, online shopping scams covers fake game store offers, and what to do after a data breach walks through password and alert steps. Browse more incidents in the breach archive.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as Capcom about 'account verification', password resets or security alerts, sent to addresses on the CAPCOM ID list.
- Fake Capcom login pages that capture passwords.
- Emails offering game codes, refunds or 'compensation' for the breach that link to malicious files or payment pages.
- Credential stuffing: attackers trying the same email and a reused password on other services.
What to do if you are affected
- 01Treat any email that appears to come from Capcom with suspicion. Do not open links or attachments, as Capcom itself advises.
- 02Go to the official Capcom site directly if you want to check your account, rather than using a link in a message.
- 03Change your CAPCOM ID password, and change it anywhere else you used the same one. Use a password manager.
- 04Turn on multi-factor authentication on the accounts that offer it, especially your email.
- 05Capcom reset 196 accounts whose passwords were changed without authorization. If you were locked out, use Capcom's support channels for your region.
Frequently asked questions
Was Capcom hacked in October 2026?
Yes. Capcom said it detected suspicious activity on its CAPCOM ID system on October 19, 2026, and confirmed unauthorized third-party access the same day.
What data was exposed in the Capcom ID breach?
Email addresses plus account data such as creation date, last login time, login count and last-used IP address in all 11,774,247 records. Forty-three records also had date of birth, gender, region and nickname.
Were Capcom passwords or credit cards stolen?
Capcom found no evidence that customer passwords were compromised and said payment card data was not affected. It did find that passwords were changed without authorization on 196 accounts and has reset them.
Do I need to change my Capcom ID password?
Capcom has not said passwords were stolen, but changing it is a low-cost precaution, especially if you reuse that password elsewhere.
Who attacked Capcom?
Unknown. Help Net Security reported that no group had claimed responsibility and that Capcom has not described the attack method.
Sources
- Capcom data breach exposes 11.7 million account records, Help Net Security, 2026-10-23
- Capcom confirms data breach affecting 11.7 million accounts, BleepingComputer, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.