Capcom says a third party accessed 11,774,247 records linked to CAPCOM ID, the account service it uses for its web services and some online games. The Osaka publisher disclosed the breach in a notice dated 22 October 2026 (Japanese version) and published a follow-up on 23 October with more detail on the most serious cases.
Email addresses for millions, store details for 19
The 22 October notice gives three overlapping figures:
- 11,774,247 records worldwide: an email address plus system identifiers, namely account creation date and time, last login date and time, number of logins and the client IP address used at the last login.
- 43 of those records also included date of birth, gender, country or region and nickname.
- 196 accounts had their login passwords changed by the intruder. Capcom has reset them.
Capcom says it has not confirmed any leak of passwords that customers set themselves, and that credit card information was not among the affected data.
The 23 October update narrows down the password cases. For 19 of the 196 hijacked accounts, the intruder also reached account pages on e-Capcom, the company’s online store in Japan. There, names (including phonetic readings), phone numbers, postal codes, addresses, gender, dates of birth, purchase history, e-Capcom inquiry history and saved address book entries were exposed. Capcom found no compromised information for the other 177 accounts and says the impact investigation is now complete.
From detection on 19 October to disclosure
- 19 October: Capcom detected signs of suspicious activity, began blocking the access and confirmed unauthorized access the same day.
- 20 October: it set up an internal incident response headquarters, confirmed that customer data had been accessed and passwords changed, and reported to its external Information Technology Security Oversight Committee.
- 21 October: it reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
- 22 and 23 October: public notice and update.
Capcom says its emergency measures are complete and that the attack method has been identified and addressed. It has not described that method publicly.
Phishing risk and support contacts
CAPCOM ID remains in service, and Capcom says the incident “does not affect players’ ability to access or play any of our games”. Registered email addresses can still be used. The main risk Capcom names is impersonation: leaked addresses could be used for fraudulent emails, texts or calls that pretend to come from Capcom or related parties, and it advises against opening links or attachments in unexpected messages. Capcom says it is contacting affected customers individually.
Most of the 11.77 million records are an email address with login metadata, not full identities, but email addresses and last-login IP addresses are useful material for targeted phishing. The e-Capcom cases are the most sensitive, since they include home addresses and purchase histories.
The notice lists regional support contacts: a toll-free line in Japan (0120-801-271, 10:00 to 20:00 JST), the Capcom support inquiry form for the Americas and Europe, and email for Asia and Oceania.
This is not Capcom’s first serious security incident. In November 2020, a ransomware attack exposed employee and business data and potentially customer data, as the company disclosed at the time.