Capcom says a third party gained unauthorised access to customer information in its CAPCOM ID account service: 11,774,247 email-address records with login metadata worldwide, 43 also with birth date, gender, country and nickname, and passwords changed on 196 accounts; no credit card data
Capcom Co., Ltd. said in a press release on 22 October 2026 that certain customer information tied to CAPCOM ID, the unified account used for its web services and needed to play some Capcom games online, was subject to unauthorised access by a third party. Capcom says the affected information (as of 22 October) is 11,774,247 records worldwide of email addresses plus system identifiers (account creation date and time, last login date and time, number of logins and the client IP address used at the last login); 43 of those records also included date of birth, gender, country/region and nickname, and login passwords on 196 accounts were changed without authorisation and have since been reset. Capcom says it has not confirmed any compromise of passwords originally set by customers and that credit card information was not included. According to Capcom's timeline, it detected suspicious activity on 19 October and confirmed unauthorised access the same day, set up an incident response headquarters on 20 October and confirmed customer information was affected, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. Capcom says it has identified and addressed the attack method, without saying what it was; services that use CAPCOM ID, including games, remain available; it will notify affected customers and has set up dedicated support channels by region, including Asia (excluding Japan) and Oceania. Capcom warns that the information could be misused for fraudulent emails or messages impersonating Capcom. BleepingComputer reported the disclosure on 22 October. Source: Capcom press release (22 Oct 2026); wire: BleepingComputer (22 Oct).
- Product
- CAPCOM ID (Capcom's unified online membership account service)
- Versions
- n/a — unauthorised access to account data; detected 19 Oct 2026; attack method not disclosed
- Exploited in Australia?
- unknown
- Patch to
- CAPCOM ID users: expect phishing that uses your email address and Capcom branding; Capcom advises not opening links or attachments in suspicious messages. Change your CAPCOM ID password if you reuse it elsewhere, and use Capcom's regional support channels (listed in its notice) for questions. Account-service operators: alert on mass account-record reads and bursts of password changes, which Capcom says it saw on 196 accounts.
Primary: Capcom — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (press release, 22 Oct 2026) · Vendor: Capcom — press release (Japanese original, 22 Oct 2026) · BleepingComputer — Capcom confirms data breach affecting 11.7 million accounts (22 Oct 2026)