Capcom has confirmed that unauthorized access to its CAPCOM ID membership service exposed 11,774,247 records worldwide, including email addresses and account-related technical information. The company announced the incident on October 22, 2026, and said emergency security measures have been completed while its investigation continues.According to Capcom’s official incident announcement, the exposed information included email addresses and system records such as account creation dates and times, last-login dates and times, login counts, and the IP address used during the most recent login.
Capcom said 43 records also contained additional personal information: dates of birth, gender, country or region, and nicknames. Separately, 196 CAPCOM ID accounts had their login passwords changed without authorization. Capcom says it has reset the passwords for those accounts.The company has not confirmed that users’ original, self-set passwords were exposed. Credit card information was not included in the leaked data, according to Capcom. The company has not publicly established the full extent of the incident, and its investigation remains ongoing.
Capcom said it detected signs of suspicious access on October 19 and began blocking the activity and investigating. The company confirmed unauthorized access that day. By October 20, its investigation had identified leaked customer information and unauthorized password changes. Capcom reported the incident to Japanese police and the Personal Information Protection Commission on October 21.The company says it has identified and addressed the attack method and completed emergency countermeasures. Services that use CAPCOM ID remain available. Capcom has also begun contacting affected customers individually, with notifications being sent sequentially.CAPCOM ID is used to access Capcom’s online services and certain game-related features. Although the exposed records include information that could help criminals craft convincing messages, Capcom has not confirmed that the leaked data has been used for further attacks.
Capcom has warned that criminals may use the exposed information to send fraudulent emails impersonating the company or related organizations. Users should be cautious with unexpected messages, avoid opening suspicious attachments or following links in them, and access Capcom services by navigating directly to the official website.As a general precaution, users who reused a password elsewhere may wish to change it on those other services. This is precautionary advice, not an indication that Capcom confirmed those passwords were stolen.Capcom says it will continue investigating the incident and provide further information if new findings emerge. For now, the confirmed figures are 11,774,247 affected records, 43 records containing additional personal details, and 196 accounts with unauthorized password changes.