Capcom Data Breach: 11.7M CAPCOM ID Records Exposed

The Capcom data breach is officially confirmed: on October 22, 2026 the company said an unauthorized party accessed CAPCOM ID and obtained email and login details from 11,774,247 records. Credit card data was not affected.

Key facts

• Announced: October 22, 2026 (official Capcom press release)
• Detected: October 19, 2026
• Records affected: 11,774,247 (email, account creation and last login dates, login count, last login IP address)
• Extra personal data: date of birth, gender, country and nickname in 43 records
• Unauthorized password changes: 196 accounts (passwords reset)
• Credit card data: not affected. Games and services keep working.
• EMEA support: Capcom Europe support form or [email protected]

What data was stolen in the Capcom data breach?

According to the official notice on Capcom's investor relations site, a third party gained unauthorized access to CAPCOM ID, the company's unified membership account. In this account system, which is required to play some Capcom games online, email addresses tied to 11,774,247 records were obtained. Those records also include account creation date, last login date, login count and the IP address used at last login. In 43 of them, date of birth, gender, country and nickname were exposed as well.

What about passwords and card details?

Capcom says it has found no evidence that user-set passwords were obtained. However, the passwords of 196 accounts were changed without authorization, and the company has reset them. Credit card information is not among the leaked data, and access to games and services that use CAPCOM ID has not been affected. Email addresses registered to CAPCOM ID can continue to be used, so there is no need to close your account or create a new one.

Timeline of the incident

Capcom's notice lays out how the incident unfolded over four days:

• October 19: suspicious activity detected and work to block access begins
• October 20: an internal crisis response headquarters is set up
• October 21: the incident is reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission
• October 22: public announcement

Capcom says it has identified and closed the method of attack, will contact affected users and has opened dedicated support channels. It added that a detailed investigation is ongoing and that it will strengthen its security based on the findings. If new information needs to be disclosed, it will post updates on its official site.

Why does CAPCOM ID affect so many players?

CAPCOM ID is the shared account system behind the online features of Capcom games, so the breach is not limited to a single title. Anyone who plays Resident Evil, Monster Hunter or Street Fighter and has linked a CAPCOM ID may be among the affected records. That includes fans waiting on Resident Evil 9 or still playing the Resident Evil 4 remake. A record count above 11.7 million shows how wide the player base touched by this incident is.

What should players do?

The biggest risk is that the leaked email addresses will be used in phishing messages impersonating Capcom. Capcom itself warns users not to click links or open attachments in suspicious emails. Basic steps you can take:

• Do not click links in emails claiming to be from Capcom that ask for passwords or payment details
• If you reuse your CAPCOM ID password elsewhere, change it on those accounts
• Turn on two-factor authentication wherever it is supported
• If your password was reset, set a new one only through Capcom's official site

Users in the EMEA region can contact the company through the Capcom Europe support form or [email protected]. Players in the Americas can use the Capcom USA support form, and a toll-free phone line has been opened for users in Japan. Capcom apologized to its customers and all stakeholders for the trouble and concern caused.

Account security in gaming is in the spotlight again

Gaming accounts are attractive targets because of the digital libraries and in-game purchases they hold. Past incidents such as the CD Projekt hack that delayed Cyberpunk 2077 patch 1.2 showed how damaging attacks on game companies can be. In Capcom's case, the lack of evidence that passwords were taken is good news, but email addresses and login history can be enough for targeted phishing.

Related reading

• Resident Evil 9 Release Date
• Resident Evil 4 Remake Release Date and Gameplay
• Cyberpunk 2077 Patch 1.2 Delayed After Hacker Attack

FAQ

How many people were affected by the Capcom data breach?

According to Capcom, email and login details from 11,774,247 CAPCOM ID records were obtained.

Was my credit card data stolen?

No. Capcom says credit card information was not among the leaked data.

Should I change my CAPCOM ID password?

Capcom says there is no evidence user passwords were obtained. Still, if you reuse the same password elsewhere, change it and turn on two-factor authentication.

Sources

• Capcom IR: Notice and Apology Regarding Customer Information Affected Through Unauthorized Access
• The Verge: Capcom data breach leaks over 11 million email addresses