Capcom has confirmed that an unauthorized third party accessed CAPCOM ID, the shared account service players use across the company’s web properties and some online games, exposing 11,774,247 records worldwide. The Japanese publisher also says attackers changed the passwords on 196 accounts, and used 19 of them to reach customer data in its Japanese online store.
No threat actor had claimed the intrusion at time of publication, and Capcom has not said how the attackers got in.
What was exposed in the main dataset
According to Capcom’s first notice published Oct 22, each of the 11.77 million records includes:
- Email address
- Account creation date and time
- Last login date and time
- Number of logins
- IP address used at the last login
A much smaller group of 43 records also exposed date of birth, gender, country or region, and nickname. Capcom says it has not confirmed that any passwords customers set themselves were compromised, and that no credit card data was affected.
196 hijacked accounts and the e-Capcom store
The more serious damage came from the 196 accounts whose passwords were changed without authorization. Capcom has since reset them. In an update on Oct 23, the company said the attacker used 19 of those accounts, all in Japan, to log in to e-Capcom account pages. e-Capcom is Capcom’s online store in Japan.
For those 19 customers, the exposed data includes:
- Names and phonetic readings of names
- Phone numbers, postal codes and addresses
- Gender and date of birth
- Purchase history, inquiry history and saved address book entries
Capcom says no other hijacked account leaked data through the password change.
Timeline from Capcom
Capcom says it detected suspicious activity on CAPCOM ID on Oct 19, blocked the access and confirmed the intrusion the same day. An internal incident response headquarters was set up on Oct 20, when the company confirmed the data exposure and the password changes. It reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on Oct 21, and went public the next day.
The company says it has “identified and addressed the attack method” and that its investigation into the scope of impact is complete, though it has not disclosed what the method was. It also has not explained how 196 passwords could be changed, so it is unclear whether attackers used previously stolen credentials or another weakness. Anything beyond that is speculation.
Why the exposed data still matters
Email addresses paired with login counts and last-used IP addresses are useful raw material for targeted phishing, and Capcom itself warns that customers may receive fraudulent emails, texts or calls impersonating the company. Players with a CAPCOM ID should treat unexpected messages about their account with suspicion, use a unique password, and turn on any available two-factor protection.
CAPCOM ID services and games remain available, and Capcom says players’ ability to play is not affected. The company says it will notify affected customers directly and has opened dedicated support channels.
A second major incident for Capcom
This is Capcom’s second major publicly disclosed cyber incident. In November 2020, the company discovered a ransomware attack by a group calling itself Ragnar Locker, which encrypted devices in the US and Japan. Capcom’s final report traced that intrusion to an old backup VPN device at its US subsidiary and confirmed 15,649 people had personal data compromised. The 2026 incident is a different type of attack with no ransomware or extortion claim attached so far.
Gaming companies remain frequent targets. BreachNews previously covered Rockstar Games confirming a breach after ShinyHunters claims, and account-takeover driven exposures like ASOS customer data exposed after stolen credential attacks.
