CAPCOM ID breach: more than 11.7 million email addresses exposed

What Capcom found

Capcom is the Japanese publisher behind Resident Evil, Monster Hunter and Street Fighter. On 22 October 2026 it confirmed that an intrusion had affected CAPCOM ID, the shared account that gives access to its web services and some of its online games. The information comes from the notice the company published, as reported by Bleeping Computer. It is the only source available to us at the time of writing, so the figures below are the ones Capcom has announced.

The publisher gave this timeline. On 19 October, suspicious activity was detected and unauthorised access was confirmed. An investigation began immediately, and by 20 October it was clear that customer data had been compromised. On 21 October, Capcom reported the incident to the police and to the Personal Information Protection Commission, Japan’s data protection authority. It is not known when the intrusion began.

The data involved

More than 11.7 million email addresses are exposed. Login data is exposed as well: the date each account was created, the date and time of the last login, the number of logins and the IP address used for the last login.

For a small group of 43 accounts, the date of birth, gender, nickname and country were also exposed. For another 196 accounts, the attackers changed the CAPCOM ID password to lock the owners out. Capcom says it stepped in and reset those passwords.

According to the publisher, the passwords of all other members were not exposed, and payment card information is not affected. Capcom’s online services are running normally.

What you can do

If you have an account, the main risk is phishing. Someone who knows your email address, knows you are a Capcom customer and knows when you last logged in can write a convincing message. Capcom itself urges caution with unsolicited messages, emails asking for additional information, and messages containing links or attachments.

In practice:

• do not open attachments in a message that claims to come from Capcom;
• never enter your login details through a link received by email: go to the website or the game through your usual browser or app;
• if you want to change your CAPCOM ID password, do it the same way, from the official website you opened yourself, never from a link;
• if you can no longer log in, use the support channels Capcom has set up for each region.

According to the source, Capcom has not asked all of its members to change their passwords, since it says those passwords did not leak. The company also says it will notify affected people in stages. So if you have not yet received a notification, that does not mean your account is unaffected.

An undisclosed method of intrusion

Capcom says it has identified how the attackers got in and has put measures in place to prevent a similar incident. It has not said what that method was. This is not the publisher’s first incident. In November 2020, an attack claimed by the Ragnar Locker ransomware group led Capcom to warn that up to 390,000 people could be affected. In April 2021, Capcom said the attackers had entered through an old VPN device.

Until your notification arrives, one simple rule is enough: an email claiming to come from Capcom should never be the way you log in to your account.