{
  "slug": "capcom-id-breach-oct-2026",
  "category": "breach",
  "title": "Capcom ID breach exposes 11.7M account email addresses",
  "summary": "Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom.",
  "cveIds": [],
  "product": "CAPCOM ID (Capcom online account service)",
  "severity": "high",
  "severityNote": "11.77M email addresses and login metadata exposed; 196 accounts had passwords changed; no payment data",
  "status": "live",
  "startedAt": "2026-10-19",
  "patchStatus": "patched",
  "patchedAt": "2026-10-19",
  "affectedVersions": [
    "CAPCOM ID accounts (11,774,247 records worldwide)"
  ],
  "fixedVersions": [
    "Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available"
  ],
  "grouping": "none",
  "timeline": [
    {
      "date": "2026-10-19",
      "title": "Capcom detects suspicious activity on CAPCOM ID, starts blocking the access and confirms unauthorized access the same day.",
      "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html"
    },
    {
      "date": "2026-10-20",
      "title": "Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed.",
      "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html"
    },
    {
      "date": "2026-10-21",
      "title": "Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.",
      "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html"
    },
    {
      "date": "2026-10-22",
      "title": "Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified.",
      "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html"
    }
  ],
  "sources": [
    {
      "kind": "news",
      "title": "11 Million Impacted by Capcom Data Breach",
      "url": "https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/",
      "publisher": "SecurityWeek",
      "date": "2026-10-23"
    },
    {
      "kind": "news",
      "title": "Capcom confirms data breach affecting 11.7 million accounts",
      "url": "https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/",
      "publisher": "BleepingComputer",
      "date": "2026-10-22"
    },
    {
      "kind": "advisory",
      "title": "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access",
      "url": "https://www.capcom.co.jp/ir/english/news/html/e261022.html",
      "publisher": "Capcom",
      "date": "2026-10-22"
    },
    {
      "kind": "advisory",
      "title": "不正アクセスによるお客様情報漏えいのお詫びとお知らせ (PDF)",
      "url": "https://www.capcom.co.jp/ir/news/pdf/261022.pdf",
      "publisher": "Capcom",
      "date": "2026-10-22"
    },
    {
      "kind": "news",
      "title": "Resident Evil makers Capcom reveal data breach has affected over 11 million Capcom ID accounts, warn against potential phishing emails",
      "url": "https://www.rockpapershotgun.com/resident-evil-makers-capcom-reveal-data-breach-has-affected-over-11-million-capcom-id-accounts-warn-against-potential-phishing-emails",
      "publisher": "Rock Paper Shotgun",
      "date": "2026-10-22"
    },
    {
      "kind": "news",
      "title": "Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide",
      "url": "https://www.notebookcheck.net/Capcom-confirms-major-data-breach-affecting-more-than-11-7-million-Capcom-ID-accounts-worldwide.1431069.0.html",
      "publisher": "Notebookcheck",
      "date": "2026-10-22"
    },
    {
      "kind": "news",
      "title": "Capcom data breach exposes 11.7 million account records",
      "url": "https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/",
      "publisher": "Help Net Security",
      "date": "2026-10-23"
    }
  ],
  "tweets": [
    {
      "authorName": "VGC",
      "handle": "VGC_News",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1231535389606895616/M-XleYjI_bigger.png",
      "text": "Capcom says a data breach resulted in the details of more than 11 million Capcom ID accounts being accessed. Credit card details are unaffected, it says.\n\nhttps://t.co/EPFUQ5uty6 https://t.co/ECTHLtmaPt",
      "date": "2026-10-22T09:46:57.000Z",
      "url": "https://x.com/VGC_News/status/2113205457397637606",
      "media": []
    }
  ],
  "notes": "How the attacker got in has not been disclosed. Capcom says it has not confirmed compromise of customer-set passwords.",
  "updatedAt": "2026-11-07T02:30:25Z",
  "stacks": [],
  "tags": [
    "capcom",
    "gaming",
    "data-breach"
  ],
  "url": "https://pwn.watch/i/capcom-id-breach-oct-2026",
  "json": "https://pwn.watch/i/capcom-id-breach-oct-2026.json",
  "sections": [],
  "agentBrief": "# Security brief: Capcom ID breach exposes 11.7M account email addresses\n\nSource: https://pwn.watch/i/capcom-id-breach-oct-2026 · status: live · severity: high · updated Nov 7, 2026, 02:30 UTC\n\n## Patch status\n**PATCHED: fixed releases exist. Upgrade to a fixed version.**\n\n## What it is\nCapcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom.\n\nSeverity detail: 11.77M email addresses and login metadata exposed; 196 accounts had passwords changed; no payment data\n\n- Product: CAPCOM ID (Capcom online account service)\n\n## Affected versions\n- CAPCOM ID accounts (11,774,247 records worldwide)\n\n## Check whether you're affected\nNo generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Secrets to rotate\nThis incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.\n\n## Latest updates\n- Oct 22, 2026: Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified.\n- Oct 21, 2026: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.\n- Oct 20, 2026: Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed.\n- Oct 19, 2026: Capcom detects suspicious activity on CAPCOM ID, starts blocking the access and confirms unauthorized access the same day.\n\n## Advisories\n- [Notice and Apology Regarding Customer Information Affected Through Unauthorized Access](https://www.capcom.co.jp/ir/english/news/html/e261022.html) (Capcom)\n- [不正アクセスによるお客様情報漏えいのお詫びとお知らせ (PDF)](https://www.capcom.co.jp/ir/news/pdf/261022.pdf) (Capcom)\n\n## Write-ups & news\n- [11 Million Impacted by Capcom Data Breach](https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/)\n- [Capcom confirms data breach affecting 11.7 million accounts](https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/)\n- [Resident Evil makers Capcom reveal data breach has affected over 11 million Capcom ID accounts, warn against potential phishing emails](https://www.rockpapershotgun.com/resident-evil-makers-capcom-reveal-data-breach-has-affected-over-11-million-capcom-id-accounts-warn-against-potential-phishing-emails)\n- [Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide](https://www.notebookcheck.net/Capcom-confirms-major-data-breach-affecting-more-than-11-7-million-Capcom-ID-accounts-worldwide.1431069.0.html)\n- [Capcom data breach exposes 11.7 million account records](https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/)\n\n## Caveats\nHow the attacker got in has not been disclosed. Capcom says it has not confirmed compromise of customer-set passwords.\n\n---\nMachine-readable: https://pwn.watch/i/capcom-id-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}