Capcom ID breach exposes data on 11.7 million accounts

On 22 October 2026, Capcom Co., Ltd. — the Osaka-based Japanese video-game publisher behind Resident Evil, Monster Hunter and Street Fighter — confirmed that a third party had gained unauthorized access to CAPCOM ID, its online account service, and leaked customer data tied to 11,774,247 records worldwide. The company said it detected and blocked the intrusion on 19 October and that its games and CAPCOM ID services remained available throughout.

According to Capcom's notice, the leaked data for the full set of records consisted of email addresses together with account-system metadata: account creation date, most recent login date and time, number of logins, and the IP address of the most recent sign-in. For 43 of those records, the attacker also reached date of birth, gender, country or region, and nickname. Capcom stated that customers' own passwords were not found to have been leaked and that no credit-card information was involved.

Unauthorized password changes

Capcom said that 196 accounts had their login passwords changed without authorization. The company has reset those passwords and is contacting the affected customers directly. Because the exposed email addresses could be used to send fraudulent messages, Capcom urged users to be wary of suspicious URLs and attachments and to avoid reusing passwords across services.

Response and open questions

Capcom moved quickly through a standard disclosure sequence: after detecting the activity on 19 October it set up an internal incident-response headquarters and briefed its security oversight committee on 20 October, then reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October before going public on 22 October. The company said it had "identified and addressed the attack method involved in this incident," but it did not describe how the intruder obtained access. With the attack vector contained and affected passwords reset, but the full investigation still ongoing, the incident's status is contained.

This is a distinct event from the November 2020 Ragnar Locker ransomware attack on Capcom, which compromised internal networks and roughly 350,000 customer and partner records; the 2026 incident is specific to the CAPCOM ID account platform and is an order of magnitude larger in the number of records exposed.