Capcom Says a Breach Exposed 11.7 Million CAPCOM ID Records and Let an Attacker Change 196 Passwords

On 22 October 2026, Capcom published a notice and an apology confirming that a third party had reached CAPCOM ID, the unified account used for its web services and required to play some of its games online. The company counted 11,774,247 affected records worldwide. What leaked was mostly email addresses and login metadata: when an account was created, when it was last used, how many times it had been used, and the client IP address recorded at the last login. On 43 of those records, date of birth, gender, country or region and nickname were also exposed. On 196 accounts, the intruder changed the login password. Capcom has reset all of them.

Related reading: Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records · Quest Diagnostics Restores Quanum Lab System After Patient Records Were Accessed.

Payment card details were not among the affected data, the company said, and it has not confirmed any compromise of passwords that customers set for themselves. Services that use CAPCOM ID remain available, and Capcom said the incident does not affect anyone's ability to access or play its games. BleepingComputer reported that Capcom has identified the intrusion method and put countermeasures in place, but has not disclosed the initial access vector. That omission is the largest gap in the public account.

The record count is not a headcount

Headlines rounded the figure to 11.7 million, a number SecurityWeek, PC Gamer, PCMag and others carried. The precise number is the one Capcom published, and it counts records rather than people. Capcom has not said how many individuals those records belong to, or whether any of the records belong to the same person. The difference matters for anyone trying to judge their own exposure: the breach is large, but "11.7 million people" is an inference the disclosure does not make.

CAPCOM ID is not a marketing mailing list. Capcom describes it as a single account that registrants use across various web services and that is needed to play certain titles online, so its reach extends past people who have only visited the company's website. The affected fields, though, are the kind every service holds for every account it has ever issued, so the record count is a poor proxy for how many people are involved.

What the attacker got, and what it is worth

Taken on its own, the data set is low sensitivity. An email address is already known to anyone who has received mail from the account holder. Login counts and last-login timestamps say something about how active an account is, and a client IP address can point to a rough location or an internet provider, but none of it is a credential. Put together, the fields describe an account: how old it is, whether it is still in use, and roughly where it was last opened. Help Net Security reported the figure as 11.7 million records.

The 43 records sit in a different category. Date of birth, gender, country or region and nickname together make a small identity profile, and those are the accounts where the exposure goes beyond a spam risk.

None of that makes the rest harmless. An address that Capcom has tied to a CAPCOM ID account is a confirmed target for phishing, and the company made that point itself. Its advisory says the affected information could be misused to send fraudulent messages impersonating Capcom or related parties, and asks customers to avoid opening URLs or attachments in suspicious mail.

Three days from detection to a public notice

The timeline Capcom published is compact. On 19 October 2026 the company detected traces of suspected unauthorized access, blocked the access, began investigating and confirmed the intrusion the same day. Emergency countermeasures started there. On 20 October it established an internal task force, found that some registered customer information had leaked and that some accounts had been illegitimately password-changed, and reported the matter to its external Security Supervisory Committee. On 21 October it reported the incident to the police and to Japan's Personal Information Protection Commission. The public notice followed on 22 October.

Capcom therefore confirmed the breach on the day it found it and disclosed three days later. The record also shows that the password changes were known internally by 20 October, two days before the public notice.

Notification will take longer than disclosure. Capcom said it will begin contacting affected customers and has set up region-specific support lines, including a toll-free number in Japan. For most account holders, the first direct word will arrive after the public notice, not with it.

The 196 password changes matter more than 11.7 million emails

A stolen email address is a nuisance. An account where someone else can set the password is a takeover, and the disclosure says that happened 196 times. That is the difference between a metadata exposure and an intrusion with operational reach.

"Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves. However, the company has confirmed that passwords were changed without authorization on 196 accounts." — Capcom, 22 October 2026

Capcom's wording leaves the mechanics open. It has not said how the passwords were changed, whether the attacker signed in with a credential first, or whether the change went through a reset flow. What it has said is narrower than "no passwords were exposed," and the gap between those two statements is not pedantry. Capcom is saying it has no evidence that customer-chosen passwords left the system while confirming that 196 of them were replaced. Whether the attacker could read anything inside those accounts before the reset is not addressed.

For everyone outside the 196, the practical risk is credential reuse. If the email address behind a CAPCOM ID also unlocks a mailbox, a store account or a work login, that address is now on a list tied to a real, active service. Attackers who buy or scrape such lists do not need the CAPCOM ID password; they need the person to trust a message that looks like it came from Capcom. The advisory's warning about impersonation is the part of the disclosure aimed at that risk.

There is also a question of what CAPCOM ID protects. It is the account layer for web services and for online play in certain games, so a takeover could expose more than a profile page, depending on what a given account can reach. Capcom has not described what the 196 accounts had access to, and it may not know yet.

This is not the 2020 attack

Capcom, which BleepingComputer puts at about 4,000 employees and $1.24 billion in annual revenue, has been here before. In November 2020 it disclosed a Ragnar Locker ransomware attack. The attackers claimed to have taken 1 TB of data, and Capcom later warned that up to 390,000 people could be affected. In April 2021 the company said the attackers had got in through an old VPN device. Its franchises include Resident Evil, Monster Hunter and Street Fighter. The 2020 intrusion reached internal systems and corporate data; this one reached the account layer that sits in front of customers.

The current incident has no ransomware claim, no extortion demand and no data dump attached to it in Capcom's account. It is larger by record count and less sensitive: emails and login times rather than a claimed terabyte of corporate data. The difference in tempo is starker. The 2020 case took months to establish its scope, with the VPN detail arriving the following spring. This one went from detection to a public notice in three days, even if the access vector is still missing.

Caveats

Capcom has not attributed the intrusion to any group, and it has not said how the attacker got in or what the entry point was. The police and regulator reports in that timeline are Capcom's own statements, not independent confirmations.

The record count is not a headcount, and the figure may still change as the investigation continues. Capcom has not said whether the affected records include dormant or closed accounts. The disclosure also does not explain how the 43 records with identity fields were selected, or whether those customers will hear from Capcom separately. Capcom's assurance that all games are unaffected is also the company's assessment of its own services, not an independent finding.

Read the password statement exactly as written. "Not confirmed" is not "not exposed." Capcom has no evidence that customer-set passwords left the system, which is a meaningful claim, and it is not a guarantee that no password was read.

What to watch

The first thing to watch is whether Capcom publishes the access vector, and whether it eventually gives a count of people rather than records. The company says it has identified and addressed the attack method. Publishing even a summary would tell other account operators whether the weakness was specific to Capcom or common to the way game accounts are built.

The second is whether 196 holds. A password-change count is easy to state and hard to bound while an investigation is live, and a revised figure would change how the incident should be read. The 43 identity records could move too.

The third is the regulator. Japan's Personal Information Protection Commission now has the case, and its response, or its silence, will say something about how Japanese authorities treat a breach of this shape: huge in records, thin in sensitive fields.

The fourth is phishing. Leaked addresses tied to a live gaming account are useful for scams that need a believable pretext, and the breach itself supplies one. Capcom has told customers what to do. The next test is whether the messages that follow look convincing enough to work.

Cover image: Capcom's Osaka headquarters, photo by Tokumeigakarinoaoshima, Wikimedia Commons, CC BY-SA 4.0.