[high] Capcom ID breach exposes 11.7M account email addresses

Thu, 22 Oct 2026 16:00:43 GMT

Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom.

Status: live · Patch: patched · Fixed in: Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available

Latest updates:

2026-10-22: Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified. (source)
2026-10-21: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. (source)
2026-10-20: Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed. (source)

pwn.watch: Capcom incident updates

[high] Capcom ID breach exposes 11.7M account email addresses