Capcom Co., Ltd. has confirmed that customer information connected to CAPCOM ID was accessed without authorization by a third party, according to a notice published on its investor-relations site. The company said emergency response measures are complete and that services using CAPCOM ID remain available. The incident does not affect the ability to access or play Capcom games, the notice states.
CAPCOM ID is a unified account required for several Capcom online services and games. The account underpins online features in titles such as Street Fighter 6 and Monster Hunter Rise. The notice does not list every affected title, but the account system’s role across Capcom’s online catalog means a compromise at this layer reaches multiple games at once.
Confirmed Data: 11,774,247 Records and Two Smaller Subsets
The notice splits the affected information into three categories. The largest category covers 11,774,247 records worldwide containing email addresses and system-specific identifier information. That identifier data includes the date and time of account creation, the date and time of last login, the number of logins, and the client IP address used during the last login. Together, those fields sketch when and how often an account was used, which is enough detail to make a fraudulent message feel tailored.
A much smaller subset of 43 records from that same total also contained date of birth, gender, country or region, and nickname. A third category covers 196 accounts where login passwords were changed without authorization, and those passwords have already been reset. Both smaller subsets are drawn from the same worldwide total of 11,774,247 records.
The notice adds that no compromise of CAPCOM ID account login passwords originally set by customers has been confirmed, and that credit card information was not included among the affected information.
Confirmed Versus Undisclosed
The notice leaves the attack method, the attacker, and the date the intrusion began unnamed. It gives no indication whether the exposed data was published or misused beyond the 196 password changes, and it offers no per-country breakdown of the 11,774,247 records, so players cannot tell from the notice alone whether their region was affected more heavily.
Three Day Timeline: Containment First, Disclosure Last
Capcom first noticed the intrusion on October 19, 2026, when it detected suspicious activity indicating potential unauthorized access to CAPCOM ID and immediately began blocking the access. That same day, Capcom confirmed that unauthorized access had occurred, implemented emergency measures, and began identifying the attack method. The next day, October 20, the company established an internal incident response headquarters and reported the matter to its external Information Technology Security Oversight Committee. It also confirmed on that day that customer information registered with CAPCOM ID had been accessed and that passwords on a limited number of accounts had been changed without authorization.
On October 21, Capcom reported the incident to Osaka Prefectural Police and Japan’s Personal Information Protection Commission. The notice went public the next day, October 22, three days after detection. Capcom stopped the access and confirmed the scope before telling the public, and the police and regulator notifications from October 21 were already in place when the notice went out.
11.7 Million Email Addresses Are the Long-Term Risk
The 43 profile records and the 196 password changes are limited in scope. Email addresses remain valid for years, and they cannot be reset by Capcom the way an account password can. A list of 11,774,247 addresses is exactly the kind of data used for phishing campaigns and credential stuffing. An attacker holding those addresses can send messages that impersonate Capcom or a related party, trying to get a player to click a link or open an attachment. The same list also feeds credential stuffing, where an attacker tries an email and a password reused from an earlier breach against other services, so a CAPCOM ID password shared with another site turns this incident into a risk on accounts elsewhere. Phishing does not need a reused password, so every address on the list is a potential target.
The login metadata also includes the client IP address used during the last login. That information can sometimes reveal approximate location or internet provider. Combined with an email address, it makes a fraudulent message more convincing. Affected email addresses may continue to be used without interruption, but there is a possibility that the data could be misused to send fraudulent emails or other communications. Capcom told customers to refrain from accessing URLs in suspicious messages and not to open attached files, because a fraudulent support email about this breach can look real.
If a CAPCOM ID password was reused on any other service, change it on those other services now. Players can also review their account for changes they did not make, such as an altered password, a changed email address, or a linked platform they do not recognize. The 196 unauthorized password changes happened without a confirmed leak of customer-set passwords. Capcom has not named the attack method, but changing a password requires write access to an account, so the attacker could modify account records. Capcom reset the 196 changed passwords but has not detailed what else was done on those accounts, so that group faces the most uncertainty. Players should reset a reused CAPCOM ID password and treat any unsolicited Capcom email as suspect. Capcom will contact affected customers directly, so an official notice about this incident should also be verifiable on the company’s site.
Support Channels and Next Steps
Capcom plans to begin contacting affected customers and has opened dedicated support channels. In Japan, a toll-free support line (0120-801-271) runs from 10:00 a.m. to 8:00 p.m. JST. North, Central and South America players are directed to the Capcom USA Customer Support Page, while Europe, Middle East and Africa players can reach Capcom Europe Customer Support at feedback@capcom.com. Asia outside Japan and Oceania has a separate contact at info-asia@capcom.com.
The company will implement measures to prevent recurrence and will publish any additional facts through its official website and other appropriate channels. The English notice is a translation of the Japanese original, which Capcom says prevails in any discrepancy. Players should monitor Capcom’s official website for further details.
