Capcom Data Breach Exposes 11.7 Million Capcom ID Accounts

Capcom has confirmed that data linked to 11,774,247 Capcom ID accounts was exposed through unauthorised access to its systems, the Japanese publisher behind Street Fighter, Resident Evil and Monster Hunter said in a notice and apology published on Thursday, 22 October 2026. The company said the exposed information is mainly email addresses and account activity data, and that customers’ own passwords and credit card information were not leaked.

Capcom ID is the free account system used for online features, news and rewards across many of the company’s games, so the incident potentially affects a large share of its global player base.

What Did Capcom Say Happened?

According to Capcom’s statement, the company detected unauthorised access on 19 October 2026 and immediately began blocking the access. It set up an internal incident response headquarters on 20 October, informed its external advisory body on IT security the same day, and reported the matter to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission on 21 October.

Capcom says it has “identified and addressed the attack method” and will contact affected customers. It has not publicly named who was responsible or described how the attackers gained access.

What Data Was Exposed?

• 11,774,247 accounts: email address, account creation date and time, last login date and time, number of logins and last login IP address.
• 43 of those accounts: also date of birth, gender, country or region, and nickname.
• 196 accounts: passwords were changed without authorisation; Capcom says these have been reset.
• Not leaked, according to Capcom: passwords set by customers and credit card information.

Capcom said its games and online services were not affected and continue to run normally. The company said it “sincerely apologizes for the complications and concern this has caused”.

Are Players at Risk of Phishing?

Even without passwords, a large list of verified email addresses tied to a gaming account is valuable to scammers. Capcom warned that the data “could be misused to send fraudulent emails or other communications impersonating Capcom”, and asked customers not to open links or attachments in suspicious messages. Typical scams after breaches like this include fake “account suspended” notices, bogus refund or reward offers, and links to look-alike login pages.

Players can reduce the risk with a few simple steps:

• Do not click login links in unexpected emails; go to the Capcom ID site or game menu directly.
• If you reused your Capcom ID password elsewhere, change it on those other services.
• Turn on two-factor authentication on the email account linked to your Capcom ID.
• Watch for messages that mention your last login time or IP address, which scammers may use to sound convincing.

Our step-by-step guide to passwords, passkeys and two-factor authentication explains how to lock down important accounts.

Has Capcom Been Hacked Before?

Yes. In 2020, Capcom was hit by a ransomware attack claimed by the Ragnar Locker group, which the company later said affected personal information of thousands of people, including employees and business partners. The latest incident arrives in a difficult year for parts of the games industry; see our report on EA’s closure of BioWare and job cuts.

What Should We Watch Next?

The key questions are how attackers reached the Capcom ID database, whether Japanese regulators take action, and whether the exposed data appears for sale online. Capcom has set up dedicated support channels, including its Capcom USA and Capcom Europe support inquiry form, for players with questions.

Featured image: Capcom headquarters in Osaka, Japan (March 2019), by Tokumeigakarinoaoshima / Wikimedia Commons, CC BY-SA 4.0. File photo.

Sources

• Capcom — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (22 October 2026).
• The Verge — Capcom data breach leaks over 11 million email addresses (22 October 2026).
• GamesRadar+ — Capcom confirms breach of 11.7 million ID accounts (22 October 2026).