Capcom says 11.7 million Capcom ID records hit by unauthorized access

Video game publisher Capcom says an outside party got into customer data linked to its online account system. In a notice, Capcom said some information tied to CAPCOM ID, its online membership service, was accessed by a third party without permission.

The largest share of the data is basic account information. Capcom said email addresses and system identifier data were affected in 11,774,247 records worldwide, and the company said no credit card information was among the affected data, according to Engadget.

Key facts

• Capcom said email and identifier data in 11,774,247 records were affected worldwide.
• Capcom said passwords on 196 accounts were changed without permission and have since been reset.
• Capcom said birth dates, gender, country or region and nicknames were affected in 43 records.
• Engadget reported that Capcom said credit card information was not part of the affected data.
• Capcom said its games and other services that use CAPCOM ID remain available.

What Capcom found

Capcom has laid out a short timeline. Engadget reported that Capcom spotted suspicious activity pointing to possible unauthorized access on October 19, 2026.

The company moved quickly after that. Capcom said that on October 20, 2026, it formed an internal incident response headquarters and told its outside Information Technology Security Oversight Committee.

Capcom also brought in the authorities. The company said it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.

The identifier data is not the same as a password. Capcom said this data covers when an account was created, the date and time of the last login, how many times a user logged in and the IP address used for the last login.

A small group of accounts saw more harm. Capcom said someone changed the passwords on 196 accounts without permission, and those passwords have been reset. Capcom also said it has not confirmed that any password set by customers themselves was compromised.

Capcom posted its first notice with numbers current as of that day. The company said it published the notice on October 22, 2026, with figures as of that date.

A follow-up added more detail. In an update on Oct. 23, Capcom said an unauthorized party reached the e-Capcom store pages of 19 of the 196 accounts. Capcom said that this exposed names, phone numbers, addresses and purchase history in 19 records in Japan.

Background

CAPCOM ID is the account many players use to reach Capcom's online features. Capcom describes CAPCOM ID as a single account used for Capcom web services and required to play some Capcom games online.

Capcom said it has found and dealt with the method used in the attack. The company has not said who carried out the attack or how the attacker got in.

There is also a question about how to count the people affected. Capcom's own figure is a count of records, not users. Engadget reported that more than 11.7 million Capcom ID users are affected, but Capcom's notice speaks only of records, and it has not confirmed an account total.

What it means for you

For most Capcom ID holders, the main risk is fake email. Engadget reported that Capcom warned the stolen data could be used to send phishing emails that pretend to come from Capcom.

The news on payment data is better. Engadget reported that Capcom said credit card information was not part of the affected data.

Most players can also keep playing. Capcom said games and other services tied to CAPCOM ID are still running.

Practical steps

• Be careful with any message that claims to come from Capcom. Capcom said that if a suspicious email or message arrives, users should not open its links or attachments.
• Watch for impersonation. Engadget advised Capcom ID holders to stay alert for phishing emails posing as Capcom.
• Wait for official word. Capcom said it will reach out to affected customers and has set up dedicated support channels.
• Check Capcom's own website for news. Capcom said it will post updates on its official site if it finds more facts that need to be disclosed.

What happens next

Capcom says it will contact the people involved. The company said affected customers will hear from it and can use dedicated customer-support channels.

More updates are possible. Capcom said it will share new information on its official website if more facts requiring disclosure come to light.

Some questions remain open. Capcom has not said who was behind the attack, and it has not described how the attacker gained access.

FAQ

Were credit card numbers stolen? No. Capcom said credit card information was not part of the affected data.

Can I still play Capcom games online? Yes. Capcom said services that use CAPCOM ID, including games, remain available.

How many passwords were changed? Capcom said passwords on 196 accounts were changed without permission and have been reset.

How many records were affected? Capcom said email and identifier data in 11,774,247 records worldwide were affected. Capcom has not confirmed how many separate accounts that represents.

Did the attackers see home addresses? For a small group, yes. Capcom said in its Oct. 23 update that names, phone numbers, addresses and purchase history were exposed in 19 records in Japan.

What should I do if I get a strange email? Capcom said users should not open links or attachments in suspicious emails or messages.