Capcom has confirmed a major data breach affecting approximately 11.77 million records worldwide after unauthorized access to its online membership service, CAPCOM ID. The incident involved leaked email addresses and related account information, while 196 accounts had their login passwords changed without authorization.
The Japanese video game company announced the breach on October 22, 2026, after discovering unauthorized access to the system on October 19. Capcom said it had implemented emergency security measures and confirmed that credit card information was not included in the leaked data.
The company is continuing to investigate the incident and has reported it to the police and Japan’s Personal Information Protection Commission.
Capcom Confirms CAPCOM ID Data Leak Affecting 11.77 Million Records
According to Capcom’s announcement, unauthorized access affected its online membership service, CAPCOM ID, which allows users to access supported services connected to the company’s games and products.
The company confirmed that information associated with 11,774,247 records worldwide had been leaked externally.
The affected information includes email addresses and system-specific account details, such as account creation dates, last login dates, login counts and the IP addresses used during the most recent logins.
Capcom also confirmed that additional personal information was exposed in a smaller number of records.
| Information | Reported Impact |
|---|---|
| Email addresses and related account information | 11,774,247 records |
| Records containing date of birth, gender, country or region, and nickname | 43 records |
| Accounts with passwords changed without authorization | 196 accounts |
| Credit card information | Not affected |
The figure of 11,774,247 represents the total number of affected records reported by Capcom, rather than a confirmed count of unique individuals.
196 CAPCOM ID Accounts Had Passwords Changed Without Authorization
One of the most concerning findings is that 196 CAPCOM ID accounts had their login passwords changed without authorization.
Capcom confirmed that it had already reset the passwords associated with those accounts.
However, the company made an important distinction: it has not confirmed that the passwords originally set by users were leaked. The confirmed issue is that passwords on 196 accounts were changed without permission.
The company is continuing to investigate the full extent of the incident and whether any additional accounts or information were affected.
For affected users, unauthorized password changes can prevent legitimate account access and may indicate that an attacker was able to interfere with account credentials. Capcom has not publicly disclosed the precise method used to gain access or change the passwords.
Capcom Discovered The Cyberattack On October 19
Capcom’s investigation began after the company discovered suspicious access involving CAPCOM ID.
The company outlined the following timeline:
| Date | Development |
|---|---|
| October 19, 2026 | Capcom discovered suspicious access and confirmed unauthorized activity. |
| October 20, 2026 | The company established an internal response team and identified the leak of customer information and unauthorized password changes. |
| October 21, 2026 | Capcom reported the incident to the police and Japan’s Personal Information Protection Commission. |
| October 22, 2026 | Capcom publicly announced the data breach and its response. |
Capcom said it had blocked the suspicious access and completed its immediate emergency response measures. The company is continuing to examine how the incident occurred and determine the full scope of the damage.
The exact attack method, the identity of the person or group responsible, and whether the breach involved a specific vulnerability have not been publicly established in the announcement.
Capcom Says Credit Card Information Was Not Leaked
Despite the scale of the breach, Capcom confirmed that credit card information was not included in the leaked data.
The company also stated that it had not confirmed the exposure of passwords originally set by users.
However, the leaked email addresses and related account information could still create risks for affected users. Criminals may attempt to use exposed information to send convincing phishing emails, impersonate Capcom or its business partners, or trick recipients into revealing account credentials.
Capcom has warned users to remain cautious about suspicious communications that appear to come from the company or related organizations.
Users should avoid opening unexpected attachments or clicking suspicious links, particularly in messages claiming that their accounts require urgent action.
Anyone who receives an unexpected account-security message should verify it through Capcom’s official website rather than relying on links included in the message.
Are Capcom Games Affected By The Data Breach?
Capcom has stated that services using CAPCOM ID remain available and the incident has not affected gameplay across its games.
The breach concerns the company’s online membership service and the customer information associated with it. Capcom has not announced that the incident disrupted its game servers or prevented players from playing its titles.
The company is known for major gaming franchises, including Resident Evil, Monster Hunter, Street Fighter, Devil May Cry and Mega Man.
Although the scale of the data leak raises concerns for users of CAPCOM ID, there is currently no confirmed indication that all these game franchises or their gameplay systems were compromised.
The company says it has completed its immediate emergency measures while continuing to investigate the incident.
What Should CAPCOM ID Users Do?
Capcom has already reset the passwords for the 196 accounts confirmed to have been changed without authorization. The company is also working to notify affected customers individually.
CAPCOM ID users should remain alert to suspicious emails, especially messages requesting passwords, verification codes or other sensitive information.
Anyone who uses the same password for CAPCOM ID and other online services should consider changing the reused password on those other services as a precaution. Using unique passwords reduces the risk that a compromised account can lead to further account takeovers.
Users should also verify account-related announcements directly through Capcom’s official channels and avoid trusting unexpected links or attachments.
Capcom Data Breach Comes Amid A Wider Wave Of Japanese Cybersecurity Incidents
The Capcom incident comes as several Japanese organizations have reported unauthorized access and potential data leaks in recent days.
On October 21, NTT Solmare, the operator of the digital manga store Comic Seymour, reported that up to approximately 4.2 million records could have been exposed following unauthorized access. The potentially affected information included email addresses, nicknames, dates of birth and gender. The company also reported the leakage of 319 records containing encrypted passwords and related information.
Other incidents reported in Japan include possible exposure of volunteer email addresses linked to the 2027 International Horticultural Expo in Yokohama, as well as personal information associated with a training website operated by a contractor for Japan’s Ministry of Health, Labour and Welfare.
Amid the series of incidents, the Tokyo Metropolitan Police Department held an emergency meeting on October 22 with companies operating critical infrastructure, including electricity, railways and telecommunications. Authorities urged businesses to strengthen their security measures, including data encryption, deletion of unnecessary personal information and the separation of backup data from connected systems.
These incidents involve different organizations and systems, and there is no confirmed evidence in the available reports that they are connected to the Capcom breach.
Capcom Continues Investigating The Incident
Capcom has apologized to customers and related parties for the concern and inconvenience caused by the breach.
The company said it would continue investigating the incident, implement measures to prevent a recurrence and further strengthen its information security framework.
The full cause of the unauthorized access and the potential consequences for affected users remain under investigation.
For now, the most important confirmed details are that 11,774,247 records were affected, 196 accounts had passwords changed without authorization, and credit card information was not included in the leak.
Capcom has completed its immediate response measures, but further findings may be announced as the investigation progresses.
Bookmark Otaku Mantra for more gaming, anime and Japanese pop culture news and updates!
About Capcom
Capcom is a Japanese video game developer and publisher headquartered in Osaka, Japan. Founded in 1979, the company is responsible for globally recognized franchises including Resident Evil, Monster Hunter, Street Fighter, Mega Man and Devil May Cry.
Its games are released across console, PC and other platforms, while its CAPCOM ID service provides account access for supported online services and products.
Source: NHK
