2026 Capcom — CAPCOM ID unauthorised access; 11,774,247 email addresses with login metadata leaked
Data compromised
Group 1 (all affected, 11,774,247): email address, account creation date/time, last login date/time, login count and client IP at last login. Group 2 (43 accounts): date of birth, gender, country or region, nickname. Group 3 (196 accounts): passwords changed without authorisation; those passwords were reset. Capcom says passwords customers set themselves have not been confirmed as leaked, and credit card data is not included.
Technical writeup
Verified Capcom press release, Oct 22, 2026 (Japanese, 不正アクセスによるお客様情報漏えいのお詫びとお知らせ): 11,774,247 email addresses worldwide leaked from CAPCOM ID, the common account for Capcom web services and some games. Timeline: Oct 19 traces found, access blocked and confirmed the same day, emergency measures taken; Oct 20 response headquarters set up and the Security Supervisory Committee notified; Oct 21 reported to police and the Personal Information Protection Commission. 196 accounts had passwords changed without authorisation and have been reset. Games and CAPCOM ID services remain available. Capcom says affected customers will be contacted individually and that new facts will be published on its website. Entry point, dates of the access itself and whether data was sold or published are not stated. companyConfirmed true.
Root cause
Not disclosed. Capcom found traces of suspected unauthorised access on Oct 19, blocked it and is still identifying the attack method.