Capcom breach: 11,774,247 CAPCOM ID records accessed, email addresses included
Capcom said on October 22, 2026 that unauthorized access to its CAPCOM ID membership service affected 11,774,247 records worldwide, including email addresses and last-login IP addresses, and that passwords were changed without authorization on 196 accounts.
What happened
Capcom, the video game company behind series including Street Fighter, said on October 22, 2026 that a third party had accessed CAPCOM ID, its unified membership account, which members use to access its web services and which is needed to play certain Capcom games online. Capcom detected suspicious activity indicating potential unauthorized access on October 19, 2026, confirmed the same day that unauthorized access had occurred, and immediately began blocking the access while it investigated. It established an internal incident response headquarters on October 20, and its investigation confirmed that customer information registered with CAPCOM ID had been accessed and that passwords on a limited number of accounts had been changed without authorization. Capcom reported the incident to its external Information Technology Security Oversight Committee on October 20, and to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21. The company says it has completed its emergency response measures and has identified and addressed the attack method used; its investigation into the full scope of the impact is continuing, and its announcement does not state when the intrusion originally began. Services that use CAPCOM ID, including games, remain available, and Capcom says the incident does not affect players’ ability to access or play its games.
Who is affected
CAPCOM ID members worldwide — 11,774,247 records in total, given by Capcom as a worldwide total with no breakdown by country or region. For each of those records the affected information is the member’s email address together with system-specific information Capcom records per account: the date and time the account was created, the date and time of the last login, the number of logins, and the client IP address used during the last login. For 43 of the records, dates of birth, gender, country or region, and nickname were also affected. Separately, 196 of the accounts had their CAPCOM ID login passwords changed without authorization; Capcom says those passwords have already been reset. Capcom has not confirmed any compromise of the login passwords customers originally set themselves, and credit card information was not included in the affected information. Capcom says it will notify the customers affected by this incident.
How serious
The concrete risk for most members is targeted phishing. A real CAPCOM ID email address, paired with account details such as when the account was created and when it last signed in, lets a scammer write a convincing message impersonating Capcom — a fake security notice or account warning that quotes true details is much harder to spot — and Capcom itself warns that the affected information could be misused to send fraudulent emails impersonating it or related parties. The last-login IP address can also indicate a member’s internet provider and approximate location. The account-takeover risk is narrower and concentrated: on the 196 accounts whose passwords the attacker changed, the attacker briefly controlled the sign-in password until Capcom reset it. Because Capcom has not confirmed that customers’ own passwords were taken, this incident does not by itself hand attackers passwords to try against other services, and no payment card data was involved.
What to do now
Follow Capcom’s own advisory first: if you receive a suspicious email or message claiming to be from Capcom or a related party, do not access any URL in it and do not open any attached files — open Capcom’s official site or your game yourself instead. Your registered email address can keep being used, per Capcom, so there is no need to abandon it. Watch for the notification Capcom says it will send to affected customers, and use only Capcom’s official support channels for questions about this incident. If you cannot sign in to your CAPCOM ID, or find your password was reset, use the official sign-in recovery route and set a new password that you do not use anywhere else. As a precaution, treat any message that quotes your Capcom account details as unproven until you have checked it on the official site — real details in a message no longer prove the message is genuine.
Sources: Capcom official notice · AUTOMATON WEST · Inven Global