# Capcom ID breach exposes 11.7M account email addresses · pwn.watch > Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom. Page: https://pwn.watch/i/capcom-id-breach-oct-2026 · generated 2026-10-23T03:01:01.167Z ## Status - Severity: high · status: live · patch: patched - Product: CAPCOM ID (Capcom online account service) - Started: 2026-10-19 - Affected: CAPCOM ID accounts (11,774,247 records worldwide) - Fixed in: Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available ## Follow this incident - RSS (one item per update): https://pwn.watch/i/capcom-id-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/capcom-id-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/capcom-id-breach-oct-2026.json - This file: https://pwn.watch/i/capcom-id-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-22: Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified. (https://www.capcom.co.jp/ir/english/news/html/e261022.html) - 2026-10-21: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. (https://www.capcom.co.jp/ir/english/news/html/e261022.html) - 2026-10-20: Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed. (https://www.capcom.co.jp/ir/english/news/html/e261022.html) - 2026-10-19: Capcom detects suspicious activity on CAPCOM ID, starts blocking the access and confirms unauthorized access the same day. (https://www.capcom.co.jp/ir/english/news/html/e261022.html) ## Fix brief # Security brief: Capcom ID breach exposes 11.7M account email addresses Source: https://pwn.watch/i/capcom-id-breach-oct-2026 · status: live · severity: high · updated Oct 23, 2026, 03:00 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom. Severity detail: 11.77M email addresses and login metadata exposed; 196 accounts had passwords changed; no payment data - Product: CAPCOM ID (Capcom online account service) ## Affected versions - CAPCOM ID accounts (11,774,247 records worldwide) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 22, 2026: Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified. - Oct 21, 2026: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. - Oct 20, 2026: Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed. - Oct 19, 2026: Capcom detects suspicious activity on CAPCOM ID, starts blocking the access and confirms unauthorized access the same day. ## Advisories - [Notice and Apology Regarding Customer Information Affected Through Unauthorized Access](https://www.capcom.co.jp/ir/english/news/html/e261022.html) (Capcom) - [不正アクセスによるお客様情報漏えいのお詫びとお知らせ (PDF)](https://www.capcom.co.jp/ir/news/pdf/261022.pdf) (Capcom) ## Write-ups & news - [Capcom confirms data breach affecting 11.7 million accounts](https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/) - [Resident Evil makers Capcom reveal data breach has affected over 11 million Capcom ID accounts, warn against potential phishing emails](https://www.rockpapershotgun.com/resident-evil-makers-capcom-reveal-data-breach-has-affected-over-11-million-capcom-id-accounts-warn-against-potential-phishing-emails) - [Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide](https://www.notebookcheck.net/Capcom-confirms-major-data-breach-affecting-more-than-11-7-million-Capcom-ID-accounts-worldwide.1431069.0.html) ## Caveats How the attacker got in has not been disclosed. Capcom says it has not confirmed compromise of customer-set passwords. --- Machine-readable: https://pwn.watch/i/capcom-id-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.