Capcom confirms data breach exposing 11.7 million customer accounts

Email addresses and login details compromised; passwords and payment data reportedly safe

By LineZotpaper

Published22 October 2026

Read Time2 min

Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information, the company disclosed on October 22.

The breach, which Capcom said it detected on October 19, involved unauthorized access to its shared account system used for web services and online games. Exposed data includes email addresses, account creation dates, last login timestamps, number of logins, and the IP address used at the last login.

For a small subset of 43 accounts, additional information such as dates of birth, gender, nicknames, and countries was also exposed. Capcom reported that for another 196 accounts, hackers changed the login passwords in an attempt to lock owners out, but the company reset them. The gaming firm emphasized that passwords for all other registered members were not exposed and that credit card information remained unaffected.

An investigation was launched immediately after the detection, and by October 20, it was clear that customer information had been compromised. The following day, Capcom reported the incident to the police and Japan's Personal Information Protection Commission.

Capcom stated that its online services remain unaffected, but urged users to remain vigilant for unsolicited communications requesting additional information or containing URLs and attachments. The company said it identified the intrusion method and implemented security measures to prevent similar incidents, though it shared no details about how the attackers gained initial access.

Affected customers will be notified in stages, likely due to the large number of accounts involved. Capcom has established region-specific communication channels for support requests.

This is not the first security incident for the company. In November 2020, Capcom suffered an attack claimed by the Ragnar Locker ransomware gang, in which attackers said they stole 1 TB of data. The company later warned that up to 390,000 people could be affected, and disclosed in April 2021 that the attackers had gained access through an old VPN device.

Analysis

Why This Matters

The exposure of 11.7 million accounts represents a significant data breach affecting users of Capcom's popular game franchises including Resident Evil, Monster Hunter, and Street Fighter
While password and payment data were reportedly safe, the exposed email addresses and login timestamps could be used for targeted phishing attacks against gamers
This is Capcom's second major security incident in six years, raising questions about the company's long-term cybersecurity posture

Background

Capcom is a Japanese video game developer and publisher with around 4,000 employees and annual revenue of $1.24 billion. Its CAPCOM ID is a shared account system that allows users to access web services and play online games. The company previously suffered a ransomware attack in 2020 that affected up to 390,000 people, with attackers gaining access through an old VPN device.

Key Perspectives

Capcom: The company has acted promptly by detecting the breach, launching an investigation, and reporting to authorities. It has implemented security measures and is notifying customers in stages. It maintains that online services are unaffected and that sensitive data like passwords and credit card information were not exposed. Affected customers: Users face potential phishing risks from malicious actors who now have their email addresses and account activity data. Those whose passwords were changed may have experienced temporary lockouts, though Capcom has reset them. Cybersecurity observers: The breach, while not as severe as some in terms of exposed data types, underscores the ongoing vulnerability of centralized account systems and the importance of multi-factor authentication and monitoring.

What to Watch

Whether further details emerge about the intrusion method, which Capcom has not disclosed
How Capcom's notification process unfolds given the large number of affected accounts (11.7 million)
Any reports of phishing or credential-stuffing attacks targeting Capcom users in the coming weeks

Sources

Capcom confirms data breach affecting 11.7 million accounts · BleepingComputer

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedThe breach affected 11.7 million customer accounts.BleepingComputer: “Capcom confirms data breach affecting 11.7 million accounts.”
Partly supportedThe summary says passwords were safe, without noting the 196 accounts whose login passwords hackers changed.BleepingComputer: “For another subset of 196 accounts, the hackers changed the CAPCOM ID login passwords in an attempt to lock the owners out, but the company took action and reset them.”
Not in the sourcesCapcom disclosed the breach on October 22.
SupportedThe usual exposed information included account creation dates, last login timestamps, login counts and the IP address used at the last login.BleepingComputer: “Apart from emails, exposed data includes account creation date, last login timestamp, number of logins, and the IP address used at the last login.”
SupportedAdditional information was exposed for 43 accounts, including dates of birth, gender, nicknames and countries.BleepingComputer: “Capcom found that for a small subset of 43 accounts, dates of birth, gender, nicknames, and countries were also exposed.”
SupportedHackers changed the login passwords for 196 accounts, and Capcom reset them.BleepingComputer: “For another subset of 196 accounts, the hackers changed the CAPCOM ID login passwords in an attempt to lock the owners out, but the company took action and reset them.”
SupportedCapcom detected suspicious activity and confirmed unauthorized access on October 19.BleepingComputer: “Capcom said it detected suspicious activity and confirmed unauthorized access on October 19.”
SupportedThe investigation began immediately, and by October 20 Capcom knew customer information had been compromised.BleepingComputer: “An investigation was launched immediately, and by the following day, it was clear that customer information had been compromised.”
SupportedCapcom reported the incident to police and Japan’s Personal Information Protection Commission on October 21.BleepingComputer: “October 21, the company reported the incident to the police and to Japan’s Personal Information Protection Commission.”
SupportedCapcom said its online services remained unaffected and urged users to be wary of unsolicited messages, URLs and attachments.BleepingComputer: “Capcom said its online services remain unaffected, but cautioned users to stay vigilant for unsolicited communications and emails requesting additional information, or messages containing URLs and attachments.”
SupportedCapcom identified the intrusion method and put security measures in place, but did not disclose how attackers gained initial access.BleepingComputer: “During the investigation, Capcom identified the intrusion method and implemented security measures to prevent similar incidents. However, no details related to the initial access have been shared.”
SupportedCapcom will notify affected customers in stages, likely because of the large number of affected accounts, and set up region-specific support channels.BleepingComputer: “The gaming firm also says it will notify affected customers in stages, likely due to the large volume of affected accounts, but it has established region-specific communication channels to submit support requests.”