The Capcom data breach has exposed email addresses and service information associated with more than 11.7 million CAPCOM ID records. Capcom disclosed the incident on 22 October 2026, three days after detecting suspicious activity within its online membership service.
The company says credit card information was not affected and it has not confirmed that passwords originally chosen by customers were compromised. However, an intruder changed the passwords of 196 accounts without authorisation, confirming that the incident involved active exploitation rather than a theoretical security weakness.
What the Capcom data breach exposed
Capcom determined that an unidentified third party gained unauthorised access to customer information associated with CAPCOM ID. The service provides a common account for Capcom websites and supports online features in certain games.
The incident affected 11,774,247 records worldwide. Each exposed record contained an email address alongside system-specific identifier information held by the CAPCOM ID service.
According to Capcom’s breakdown, the exposed information included:
- Email addresses associated with CAPCOM ID records.
- The timestamp showing when an account was created.
- The timestamp of the account’s last login.
- The number of recorded logins.
- The client IP address used for the most recent login.
A much smaller subset of 43 records contained additional profile information. Those records included a date of birth, gender, country or region and nickname.
Capcom stated that credit card details were not included in the affected information. This distinction limits the immediate risk of direct payment fraud, although the exposed email addresses and account activity data remain useful to criminals preparing convincing phishing messages.
Unauthorised changes to 196 accounts
During its investigation, Capcom found that passwords on 196 CAPCOM ID accounts had been changed without authorisation. The company reset the affected passwords as part of its emergency response.
Capcom has not confirmed that the passwords originally set by customers were exposed or obtained by the attacker. The difference is important: the available evidence confirms unauthorised access and account changes, but does not establish that the wider password database was compromised.
The Capcom data breach relates to the CAPCOM ID service rather than a particular software release, so there are no affected product versions to list. Media reports note that CAPCOM ID supports online titles including Street Fighter 6, but Capcom has not restricted the incident’s scope to one game or platform.
Capcom data breach timeline
Suspicious activity detected on 19 October
Capcom detected suspicious activity indicating possible unauthorised access to CAPCOM ID on 19 October 2026. It blocked the access, confirmed that unauthorised activity had occurred and began emergency measures to investigate the incident and identify the attack method.
This initial response focused on preventing further access while determining what information the attacker had reached. Capcom has since said that it identified and addressed the method used, although it has not released technical details explaining the vulnerability or intrusion route.
Incident response expanded on 20 October
On 20 October 2026, Capcom established an internal incident response headquarters. Its investigation confirmed that some customer information had been exposed and identified unauthorised password changes affecting a limited number of accounts.
The company’s Security Supervisory Committee was also notified. Investigation and monitoring continued as Capcom worked to establish the number of affected records and the types of information involved in the Capcom data breach.
Regulators and police notified on 21 October
Capcom reported the incident to police and Japan’s Personal Information Protection Commission on 21 October 2026. At that stage, it continued monitoring the service and assessing the incident’s scope.
The company completed emergency response measures, reset the passwords of the 196 affected accounts and addressed the identified attack method. It says CAPCOM ID services remain available and gameplay has not been affected.
Public disclosure on 22 October
Capcom publicly disclosed the incident through an investor relations announcement on 22 October 2026. The disclosure provided the confirmed figure of 11,774,247 exposed records and clarified that only 43 contained the additional profile fields.
As of 22 October 2026, Capcom had not attributed the attack to a named person or group. It had also not confirmed any public release of the data or publication of a proof of concept or technical exploit.
How the CAPCOM ID attack worked
The Capcom data breach is confirmed as in-the-wild malicious activity because an unauthorised third party accessed records and changed passwords on 196 accounts. However, the company has not described whether the attacker exploited a software flaw, abused credentials, targeted an application programming interface or used another technique.
Capcom says it identified and addressed the method of attack, but no indicators of compromise have been made public. This means other organisations cannot use vendor-provided IP addresses, file hashes or domains to determine whether they encountered related activity.
The exposed timestamps, login counts and last-login IP addresses may provide useful context for social engineering. An attacker could combine this information with an email address to make a fraudulent security notice or account alert appear more credible.
Capcom plans to notify affected customers and has established contact channels for enquiries. Its guidance asks customers to remain alert to phishing emails and avoid links or attachments in suspicious messages.
Why the Capcom data breach matters to UK organisations
Although the incident concerns consumer accounts, exposed CAPCOM ID addresses may include corporate email addresses or personal addresses used by employees. Criminals could use Capcom-themed password reset messages to steal credentials or deliver malicious files.
The risk increases where somebody reused a CAPCOM ID password for a work account. Capcom has not confirmed that customer-selected passwords were compromised, but the unauthorised changes to 196 accounts justify reviewing any reused credentials rather than waiting for further evidence.
Actions following the Capcom data breach
Organisations should keep their response proportionate and tied to the confirmed exposure. Relevant measures include:
- Warn staff to treat unexpected CAPCOM ID security alerts, password resets and attachments as suspicious.
- Ask employees who reused a CAPCOM ID password on a work service to replace the work password immediately.
- Enable multi-factor authentication on corporate accounts to reduce the impact of stolen or reused credentials.
- Verify Capcom communications through the official service rather than following links in unsolicited emails.
- Monitor for repeated login attempts involving email addresses that may have been used with CAPCOM ID.
The Capcom data breach did not expose credit card information, according to the company, and normal CAPCOM ID services remain available. The principal immediate risks are targeted phishing, attempted account takeover and credential reuse involving the 11,774,247 exposed email records.
Originally reported by Video Games Chronicle.
