Capcom said on October 22, 2026 that a third party accessed 11,774,247 CAPCOM ID records, including 196 accounts whose passwords were changed without authorization. The company says it has not confirmed any leak of the passwords users originally set.
At a Glance
- Capcom says the exposed records pair email addresses with login history and the IP address used for each account’s last sign-in.
- Capcom found unauthorized password changes on 196 accounts and says it has already reset every one of those passwords.
- Credit card data was not part of the affected information, and Capcom says its games and online services remain available.
- Japanese police and the national privacy regulator received Capcom’s incident reports two days after the company first spotted suspicious activity.
Capcom (TSE: 9697), the Osaka publisher behind Resident Evil and Monster Hunter, runs CAPCOM ID as one account across its web services. Players also need it for certain Capcom games online, so the exposed pool reaches well past any single title.
Capcom’s notice spells out what sits in each exposed record. Each one ties an email address to the account’s creation time, its login count and its last-login time. It also carries the client IP address used for that last login. A much smaller group of 43 records exposed date of birth, gender, country or region, and nickname as well.
ALERT – Japanese video game company Capcom says a data breach exposed email addresses and account data for nearly 11.8 million CAPCOM ID accounts worldwide. Passwords on 196 accounts were changed without authorization, the company says https://t.co/mRfj2IsWoc
— Insider Paper (@TheInsiderPaper) October 22, 2026
Password changes came without a confirmed password leak
The detail that stands out is one Capcom hasn’t explained. The company said it has “not confirmed any compromise of CAPCOM ID account login passwords” that customers set themselves. Someone still changed the passwords on those 196 accounts, though, and Capcom has since reset them.
If the original passwords really were never exposed, the attacker reached those accounts some other way. Capcom says it has identified and addressed the attack method, but the notice doesn’t describe it. The disclosure confirms the changes happened and says nothing yet about how they were made.
Capcom spotted suspicious activity on October 19 and began blocking access that day. It set up an internal incident response headquarters the next day and reported the matter to its external Information Technology Security Oversight Committee. On October 21, it reported the case to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission (PPC, the country’s data protection authority).
The leaked metadata hands scammers convincing details
The exposed fields look dull, but a scammer can use every one of them. An email quoting a player’s real sign-up date or last-login IP address reads like a genuine Capcom alert. Capcom itself warned that the data could fuel fraudulent phishing emails impersonating the company or related parties.
The notice still leaves several questions open:
- How did the attacker get in, and how long did access last before Capcom detected it?
- How were those passwords changed if the originals were never exposed?
- Did the attacker copy the full set of records, or only view them?
- Why did 43 records expose extra profile fields while the rest did not?
The copying question matters most, since a downloaded dataset can be traded and reused after a breach long after the original incident closes.
What’s Next?
CAPCOM ID holders can act now:
- Try signing in. If the password no longer works, contact Capcom through its official channels, never through a link in an unsolicited message.
- Change the CAPCOM ID password and any other account that shares it. That helps reduce risk even without a confirmed leak, especially where a password is reused across services.
- Treat any email or message claiming to come from Capcom with suspicion, and skip its links and attachments.
- Use the dedicated support routes. Japan has a toll-free line, 0120-801-271. Players in the Americas and EMEA can use the Capcom support inquiry form, and the rest of Asia and Oceania can email info-asia@capcom.com.
Capcom says its next step is contacting affected customers directly. It will post updates on its official website if further facts requiring disclosure emerge. Until a real notice lands, every message claiming to be one deserves a second look. A fake that quotes a player’s actual login history is exactly what this data makes possible.
