Capcom: Unauthorized Access to CAPCOM ID Exposes 11.7M Account Records

Capcom has confirmed that an unidentified third party gained unauthorized access to CAPCOM ID, its unified online membership service. The company's notice of October 22, 2026 puts the exposure at 11,774,247 email address records worldwide, plus account metadata including the client IP address used at last login. A much smaller set of 43 records also exposed date of birth, gender, country/region and nickname. The attacker changed the login passwords on 196 accounts without authorization. Capcom says user-set passwords were not compromised and no credit card data was involved. No threat actor has claimed the attack, and Capcom has not disclosed how the intrusion happened.

A note on sourcing: none of the eight sources used here is tagged PRIMARY. However, S2 is Capcom's own investor-relations press release, so this brief treats it as the authoritative account. Every other source repeats its figures. The record counts match across all coverage, so no range needs to be reported. The differences are in framing, covered below.

What Happened

Capcom's notice and the outlet coverage give this timeline:

• October 19, 2026: Capcom detected signs of unauthorized access and began blocking it (PC Gamer, Notebookcheck, ConsolePCGaming). IGN describes October 19 as the date the data "was accessed," not the date it was detected. No source says how long the attacker had access before detection, so the true start of the intrusion is unknown.
• October 20: Capcom set up an internal task force to gather information and prevent further damage.
• October 21: Capcom reported the incident to police and to Japan's Personal Information Protection Commission (PPC). IGN names the Osaka Prefectural Police specifically.
• October 22: Capcom published its public notice and apology, signed for the company by President and COO Haruhiro Tsujimoto.

Capcom says it has completed emergency response measures and has "identified and addressed the attack method." CAPCOM ID services remain online, and the company says the incident does not affect access to its games. It plans to notify affected customers directly. Capcom has also opened region-specific support channels, including a toll-free line in Japan and inquiry forms for the Americas and EMEA (Final Weapon). The investigation is ongoing, and Capcom says it will publish any further material findings on its official website.

What Was Taken

Capcom's notice describes three tiers of impact. Tiers 2 and 3 are subsets of tier 1.

1. 11,774,247 records (worldwide): email address plus system-specific identifiers: account creation date/time, last login date/time, number of logins, and client IP address at last login.
2. 43 records: additionally exposed date of birth, gender, country/region and nickname.
3. 196 accounts: login passwords changed without authorization. Capcom has since reset them.

Not affected, per Capcom: credit card information, and any password that customers set themselves.

Framing discrepancies to watch: - Capcom counts records. VGC, ConsolePCGaming and DualShockers say accounts, and PC Gamer's headline says people. One person can hold more than one account, so the number of unique individuals may be lower than 11.77M. Capcom has not said. - Several headlines group birthdays with emails and IPs as though they were exposed at the same scale. In Capcom's figures, birthdays and the other profile fields were exposed for only 43 records. The 11.7M figure covers emails, IPs and login metadata.

Sensitivity: Each record on its own is low-sensitivity. At this volume, though, the combination of a verified email address, a recent IP address (which gives rough location) and a last-login timestamp makes a high-quality targeting dataset.

Why It Matters

• Phishing at scale is the main downstream risk. Capcom itself warns that the exposed addresses could be used for fraudulent emails impersonating the company. Attackers can quote a real account creation date or last-login time to make a lure convincing. Players of Street Fighter 6, Monster Hunter and Resident Evil are a large, identifiable audience for fake "account security" or "compensation" emails.
• The 196 password changes point to account-level control, not just a database read. An attacker who can change passwords without knowing the original ones has, at least briefly, been able to act on accounts. That is a bigger concern than passive exfiltration, and it suggests the compromise reached account-management functions.
• IP addresses are personal data. Exposing them to this many records globally is likely to draw scrutiny beyond Japan's PPC, for example from GDPR authorities over EMEA users.
• Unified identity is a single point of failure. CAPCOM ID is a single login that covers multiple web services and online game features. Centralizing identity this way puts every connected service in scope if the identity layer is breached.
• Capcom has been breached before. Its 2020 ransomware incident is outside the sources used here, but the repeat makes this one a reputational issue as well as a technical one.

The Attack Technique

Not disclosed. Capcom says only that it has "identified and addressed the attack method." No source names a threat actor, an initial access vector or a vulnerability, and none reports a ransom demand or a leak-site listing.

The following is analytical inference, not confirmed fact. The pattern Capcom describes is a large exposure of email and login metadata, a tiny subset of richer profile data, and password changes with no evidence of password theft. That pattern fits several scenarios: abuse of an account-recovery or password-reset flow, an authorization flaw (such as IDOR) in an account-management API, or compromised administrative or support tooling with write access to accounts. Any of these would let an attacker enumerate records and overwrite credentials without reading stored password hashes. Treat these as hypotheses until Capcom or the PPC publishes more detail.

What Organizations Should Do

1. Harden account recovery and password-change paths. Require re-authentication or out-of-band confirmation for every credential change, notify the old email address of the change, and rate-limit and monitor reset endpoints for enumeration.
2. Test identity APIs for object-level authorization flaws. Check that profile and account endpoints cannot return or modify another user's record by changing an identifier. Include bulk-read and admin endpoints.
3. Restrict and audit privileged support and admin tooling. Put phishing-resistant MFA, just-in-time access and session logging on any internal tool that can view or change customer accounts, and alert on bulk lookups.
4. Minimize stored identity data. Ask whether you need to keep last-login IP and login counts tied to the email address indefinitely. Shorter retention and keeping telemetry separate from identity records both reduce the impact of a breach.
5. Prepare for impersonation follow-on. If your brand is mentioned in a breach like this, enforce DMARC at p=reject, watch for lookalike domains, and send customer notices that never include links or attachments, so users have a simple rule to follow.
6. Users and security teams should treat Capcom-themed email as suspect. Don't click links or open attachments in unexpected Capcom messages. Go to the account directly, enable MFA where it is offered, and add these lures to phishing-awareness and mail-filter rules.

Sources: Capcom confirms a data breach has affected over 11 million people,... | Notice and Apology Regarding Customer InformationAffected Through U... | Capcom says a data breach affected more than 11 million Capcom ID a... | Capcom confirms major data breach affecting more than 11.7 million... | Capcom Says Breach Exposed Data From 11.7 Million Capcom ID Accounts | Capcom’s Data Breach Hit 11.7 Million Accounts, and Your Inbox Is t... | Capcom Confirms Data Breach Affecting Over 11 Million CAPCOM ID Acc... | Resident Evil Developer Capcom Issues Phishing Warning After Data B...