October 22, 2026: Capcom confirmed unauthorised access to CAPCOM ID, the account system used across its web services and some of its games. The company says 11,774,247 email addresses were leaked, along with account dates, login history and the IP address of each account's most recent sign-in. For 196 accounts, passwords were changed without authorisation, and those passwords have been reset. Canonical: capcom-capcom-id2026. Primary source: Capcom's press release.
CAPCOM ID is a single login for many of Capcom's products, so a breach of the account system touches far more than one game. Capcom has said that gameplay and CAPCOM ID services remain available, and that no credit card data was included in the leak. The notice is in Japanese; the details below come from its own wording.
What Capcom has confirmed
- All affected accounts (11,774,247): the email address, the date and time the account was created, the date and time of the last login, the number of logins, and the IP address used at the last login.
- 43 accounts: in addition, date of birth, gender, country or region, and nickname.
- 196 accounts: passwords were changed without authorisation. Capcom has reset these passwords.
- Not confirmed: leakage of passwords that customers set themselves. Capcom says it found no evidence of that.
- Not included: credit card information.
Capcom says the affected customers will be contacted one by one, and that it will publish new facts on its website if they come to light.
Timeline
- October 19: Capcom found traces of suspected unauthorised access and blocked it. The same day it confirmed the access had happened, took emergency measures and began identifying how the attack was carried out.
- October 20: Capcom set up an internal response headquarters. The investigation found that part of the customer data had leaked and that some accounts had unauthorised password changes. The company notified its external Security Supervisory Committee.
- October 21: Capcom reported the incident to the police and to Japan's Personal Information Protection Commission.
- October 22: the notice was published with the 11,774,247 figure.
Technical analysis
Capcom has not described the attack method. What it has described is the shape of the data, and that shape says a lot about the likely access. An account system holds a few kinds of information that are useful together: a verified email address, when the account was created, when it was last used, how often it was used, and which address it was last used from. None of those fields is a password, but together they let a criminal target the account holder convincingly.
The 196 accounts with unauthorised password changes point to a separate step. Changing a password requires access to the account, so the attacker either had a working login for those accounts or a way to reset them. Capcom has not said which. The fact that the number is small compared with the total suggests that the attacker did not change passwords at scale, but the company has not published a method, and the investigation may refine the figures.
The timing is also worth noting. Capcom found the activity on October 19 and blocked it the same day, but the notice gives no date for when the access started. That gap matters for customers: the leaked fields were copied during some earlier window, and a copy taken then stays useful after the access is blocked.
Why an email list with login metadata is dangerous
An email address on its own is a phishing target. Add the account creation date and last login, and the message can look like it came from someone who knows the account. Add the IP address and the login count, and an attacker can tell whether a victim is an active player worth targeting. Capcom warns that the leaked data could be used to send messages that impersonate the company, and advises users not to open links or attachments in unexpected messages.
For the 43 accounts with date of birth, gender, country and nickname, the risk goes further: those fields are often reused in identity-verification questions and in password-reset flows on other sites.
Verified vs unverified
- Verified (Capcom notice): the 11,774,247 count, the data categories, the 43 and 196 subsets, the timeline, the agencies notified, and the statement that credit card data was not included.
- Company statement: no evidence that customer-set passwords leaked, and that services remain running.
- Unknown: the entry point, when the access started, whether the data has been sold or published, and whether any account was used to buy items or access payment details.
Who should act and how
- Change your CAPCOM ID password if you reused it anywhere else, and change it on every other site that used the same password.
- Turn on two-factor authentication for CAPCOM ID if the service offers it, and for your email account, since email is the recovery route for most gaming accounts.
- Do not click links in unexpected Capcom emails. Go to the Capcom site or app yourself. Capcom's notice says it will not ask you to act through links in unsolicited messages.
- Check your account for changes: linked email addresses, recovery details, purchases and any connected payment or platform accounts.
- Watch for targeted scams that quote your account date, nickname or country. Those details are in the leak, so they do not prove that the sender has your password.
- If you used the same email address for other sensitive accounts, check them as well. The leak covers the address, not the other accounts behind it.
Context
Breaches of gaming and entertainment accounts are common, and we have covered several in our catalog, including the earlier Capcom incident from 2020. Email-based leaks are usually followed by phishing waves within days, so the first week after a notice like this is when most of the fraud happens. The SBI leak published on this site shows the same pattern: personal details leaked first, impersonation calls followed.
Sources
Capcom press release (Japanese) • Notebookcheck • CyberInsider