Security Guides
Capcom CAPCOM ID Breach (11,774,247 Records): Email Addresses and Login Data Leaked — What Account Holders Should Do
Capcom announced on October 22, 2026 that unauthorized access to its CAPCOM ID account service leaked email addresses and login data in 11,774,247 records worldwide, and that passwords on 196 accounts had been changed. Who is affected and what to do.
For: anyone with a CAPCOM ID (the shared account for Capcom web services and some online games), people who play Capcom games outside Japan, and anyone who runs a service with member accounts. This article is based on the official notice from Capcom Co., Ltd., the Japanese game company, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of 11:00 JST, October 23, 2026Not yet known
- The attack method, route and when the access began (not disclosed)
- Results of the investigation into the scope (continuing)
- How passwords are stored (not mentioned)
- What was done on the 196 accounts after the passwords were changed
- How and when affected customers will be contacted
- How many people the record count represents
The company says it will continue a detailed investigation and will promptly announce any new facts that should be disclosed on its official website and other channels. No timing is given.
As of 11:00 JST on October 23, no follow-up had appeared in the company's IR news list or in the Tokyo Stock Exchange's timely disclosure system (TDnet). The notices section of the CAPCOM ID site carries a short notice dated October 22 announcing the leak and pointing to Capcom's notice page for details.
What CAPCOM ID holders should do today
Do not open links or attachments in emails claiming to be Capcom or a game
The company warns that the leaked data could be used to send fraudulent emails or other messages impersonating Capcom or related parties, and asks customers not to access URLs in them or open attachments.
Even if the subject says something like "Your account will be suspended", "You need to reset your password" or "Compensation for in-game items" (this site's examples), do not log in through the link. Open the official CAPCOM ID site from a bookmark or your own search. The basics of spotting fake emails are in What is phishing.
Change your password on any other service where you reuse it
The company says it has not confirmed any leak of passwords set by customers themselves, and it has not asked anyone to change passwords.
However, the CAPCOM ID login ID is the email address. In general, attackers try logging in by combining leaked email addresses with passwords leaked from other sites. If you use your CAPCOM ID password on other services, change them so that each is different. This is this site's general advice, not the company's. You can check whether your passwords have leaked before with How to check if your password leaked.
Turn on two-factor authentication for CAPCOM ID
According to the company's support page, CAPCOM ID lets you set up two-factor authentication (a code from an authenticator app on your phone, in addition to your password) from your Account page.
With it on, knowing your email and password is not enough to log in. The company notes that you need to turn two-factor authentication off before changing phones. How to choose a method is covered in Choosing multi-factor authentication.
If you cannot log in or your details have changed, contact the support channel
The company says it confirmed that passwords on 196 accounts had been changed without authorization and that it has already reset them.
If you cannot log in or see changes you did not make, contact the support channel for your region listed on the notice page. In Japan this is the dedicated CAPCOM ID data security incident support line (toll-free 0120-801-271, 10:00 to 20:00 JST). Check the number on the notice page rather than using a number in an email you received.
For users outside Japan
The 11,774,247 records are a worldwide total. The company has set up a separate support channel for each region.
| Region (from the company's notice) | Where to ask |
|---|---|
| Japan | Dedicated CAPCOM ID data security incident support line (toll-free 0120-801-271, 10:00 to 20:00 JST) |
| North, Central and South America | Capcom USA customer support inquiry form |
| Europe, Middle East and Africa | Capcom Europe customer support inquiry form, or email |
| Asia (excluding Japan) and Oceania | Capcom Asia customer support email |
The form URL and email addresses are listed on Capcom's notice page (in Japanese and English). In the English version, the Asia and Oceania entry is labelled "Capcom Europe Customer Support"; the Japanese original, which prevails, calls it Capcom Asia Customer Support. Check the contact details on the notice page, not in an email you received.
What happened (from Capcom's notice)
Capcom Co., Ltd. published "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access" on October 22, 2026. The same document was filed on the Tokyo Stock Exchange's timely disclosure system (TDnet) at 17:00 JST that day. Everything below is based on the company's notice and the notice on the CAPCOM ID site.
October 19, 2026 (Mon)
The company found traces suggesting unauthorized access to CAPCOM ID, immediately began blocking the access and investigating the cause and scope. The same day it confirmed that unauthorized access had occurred and took emergency measures.October 20 (Tue)
The company set up an internal incident response headquarters. The investigation found that part of the customer information registered with CAPCOM ID had leaked and that passwords on some accounts had been changed without authorization. The same day it reported the matter to its external advisory body, the Information Technology Security Oversight Committee.October 21 (Wed)
The company reported the incident to the police (the Osaka Prefectural Police, according to the English version) and to Japan's Personal Information Protection Commission.October 22 (Thu)
The notice was published and also posted on the CAPCOM ID site. It said it would contact affected customers individually and set up dedicated support channels.
The notice does not say when the unauthorized access began. October 19 is the day the company found the traces.
- Company
- Capcom Co., Ltd.
- Service
- CAPCOM ID, the online membership account used for Capcom web services and needed for some online games
- Leaked data
- Email addresses and system-specific identifier information (account creation date and time, last login date and time, number of logins, client IP address at last login): 11,774,247 records (worldwide total)
- Leaked for some
- Date of birth, gender, country/region, nickname: 43 of the records above
- Passwords
- No leak of customer-set passwords confirmed. Passwords on 196 of the accounts above had been changed without authorization and have been reset
- Not included
- Credit card information
- Cause
- Unauthorized access by a third party. The company says it has identified and addressed the attack method. The method and route have not been disclosed
- Reports
- Police (Osaka Prefectural Police in the English version) and the Personal Information Protection Commission (October 21); the company's external Information Technology Security Oversight Committee (October 20)
- Services
- Services using CAPCOM ID remain available. No game is affected for play. Registered email addresses can continue to be used
- Contacting customers
- Affected customers will be contacted individually (method not stated)
- Prevention
- The company says it will take measures based on the cause it identified and strengthen its information security. No specifics are given
What is known and what is not
This is the state as of 11:00 JST, October 23, 2026. When a follow-up is published, the status column will be updated.
| Item | What the notice says | Status |
|---|---|---|
| Discovery and start of blocking | Traces found on October 19; the company immediately began blocking the access and investigating the cause and scope; unauthorized access confirmed the same day | Confirmed (company) |
| Email addresses and identifier data | 11,774,247 records (worldwide). Identifiers: creation time, last login time, number of logins, client IP at last login | Leak confirmed (company) |
| Birth date, gender, country/region, nickname | 43 of the records above | Leak confirmed (company) |
| Unauthorized password changes | 196 of the accounts above; reset | Confirmed (company) |
| Passwords set by customers | No leak confirmed | Not confirmed (company) |
| How passwords are stored | Not stated | Not mentioned |
| Credit card information | Not among the affected data | Not included (company) |
| Name, postal address, phone number | Not listed among the leaked items | Not mentioned |
| Cause | Unauthorized access by a third party; attack method identified and addressed; method and route not stated | Confirmed (company) / details not mentioned |
| When the access began | Not stated | Not mentioned |
| Scope | Investigation continuing | Under investigation |
| How many people | Given as a count of records or accounts, not people | Not mentioned |
| Reports to police and the regulator | Made on October 21 | Confirmed (company) |
| Contacting affected customers | Will contact affected customers individually (method not stated) | Planned (company) |
| Services and games | Remain available; no effect on play | Confirmed (company) |
| Misuse of the leaked data | Warns that suspicious emails may be sent; does not say any misuse has been confirmed | Not mentioned |
Reading note: "not confirmed" versus "not included"
The notice says credit card information was "not included among the affected information". For passwords, it says only that no leak has been confirmed, which is not the same as saying passwords were outside the scope.
The 196 "unauthorized password changes" do not mean passwords leaked; they mean a third party had changed the passwords on those accounts. Keep the two apart, as the notice does.
What the leaked items can be used for
The following describes what can happen in general, not what has happened in this case. The notice does not say any misuse has been confirmed.
Email address (shows you use CAPCOM ID)
↓→
Fake emails claiming to be Capcom or a game
→ Do not log in through links; open the official site from a bookmark
Email address = login ID
↓→
Login attempts using passwords leaked from other sites
→ Do not reuse passwords; turn on two-factor authentication
Creation time, last login time, number of logins
↓→
Convincing fake alerts such as "We detected a login on [date]"
→ A correct date is not proof that a message is genuine
Not included, or no leak confirmed, according to the notice
- Credit card information (not included)
- Passwords set by customers (no leak confirmed)
Items the notice says leaked
- Email address (also the login ID)
- Account creation time, last login time, number of logins
- Client IP address at last login
- For 43 records, birth date, gender, country/region and nickname
Unlike a password, an email address is hard to change quickly. In general, fake emails on other pretexts can reach a leaked address long after the event, so stay alert for a while.
Other October 2026 cases centred on email addresses are the Lawson ID breach and the JR East, VIEW Card and JR Kyushu email address leak. The cause and scope differ from case to case, so this one will not necessarily follow the same course.
This is a different incident from Capcom's 2020 case
In November 2020, Capcom was hit by a ransomware attack and announced that personal data had been leaked (Capcom Ransomware (2020)). The current notice concerns a separate incident of unauthorized access to CAPCOM ID, and it does not mention any link to the 2020 case.
For people who run services with member accounts
The company has not disclosed the attack method, so this section does not say how to prevent it, and it is not an assessment of the company's response. What the notice does show is that email addresses that double as login IDs leaked, and that passwords on some accounts had been changed. The steps below focus on what you can review in advance in light of those two points.
Tell the account holder when a password or email address changes
In this case, the company confirmed that passwords on 196 accounts had been changed without authorization. In general, notifying account holders of password changes lets them notice changes they did not make.
Sending the notification to the contact details on file before the change means it still reaches the real owner if someone has replaced them. If the notification says "if this wasn't you", explain how to check on the official site rather than including a link, so it is easier to tell apart from fake alerts.
Decide how long to keep login history fields
The leaked items include the last login time, number of logins and client IP address at last login. These help detect unauthorized logins, but if they leak they reveal how an account is used.
Deciding which history to keep next to the account record, and for how long, keeps the scope smaller if a leak happens. Records used to monitor for unauthorized logins can also be kept separately, with a defined purpose and retention period.
Offer two-factor authentication in a way people actually use
CAPCOM ID offers two-factor authentication (company support page). In general, two-factor authentication that is merely available tends to be little used, and it protects only those who turn it on.
Prompting users to set it up on the login screen or before important actions, and supporting passkeys, can increase uptake. The differences are explained in What is two-factor authentication and What is a passkey.
Sources (public record)
The facts in this article are based on the public information below. The undisclosed attack method and route are not guessed at.
- Capcom Co., Ltd., "不正アクセスによるお客様情報漏えいのお詫びとお知らせ" (Japanese original, October 22, 2026) — capcom.co.jp (PDF: capcom.co.jp)
- Capcom Co., Ltd., "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access" (English, October 22, 2026) — capcom.co.jp (PDF: capcom.co.jp)
- Tokyo Stock Exchange timely disclosure service (TDnet), filing at 17:00 JST on October 22, 2026 (checked October 23) — release.tdnet.info
- CAPCOM ID, notice on unauthorized access and customer information (notices section, October 22, 2026) — cid.capcom.com
- CAPCOM ID, "Support" (login and two-factor authentication, checked October 23) — cid.capcom.com
- Capcom Co., Ltd. IR news list (checked October 23; no follow-up) — capcom.co.jp
- BleepingComputer, "Capcom confirms data breach affecting 11.7 million accounts" (October 23, 2026, news report) — bleepingcomputer.com
Update history
2026-10-23: First version, based on Capcom's notice of October 22 (Japanese and English), the TDnet filing, and the CAPCOM ID notice and support page (checked at 11:00 JST on October 23). The scope is still under investigation; this article will be updated when a follow-up is published.
Read next
- Capcom's separate 2020 case: Capcom Ransomware (2020)
- Cases from the same period: Lawson ID breach / Carsensor.net and C-MATCH breach
- Preparing for fake emails: What is phishing / Spam from your own email address
- Protecting accounts: Choosing a password manager / Choosing multi-factor authentication
- Other incidents of 2026: Data breaches and cyberattacks of 2026 (Japan and worldwide)
FAQ
QWhat leaked in the Capcom breach?
According to Capcom Co., Ltd.'s notice of October 22, 2026, email addresses registered with its CAPCOM ID account service, together with system-specific identifier information (account creation date and time, last login date and time, number of logins, and the client IP address used at the last login), leaked in 11,774,247 records worldwide. For 43 of those records, date of birth, gender, country/region and nickname also leaked. The Japanese original says the leak has been confirmed, not that data may have leaked.
QAm I affected?
The scope is CAPCOM ID accounts. The count is a worldwide total, so users outside Japan are included. The company says it will contact affected customers individually, but does not say how. The figure is a count of records or accounts and has not been given as a number of people. If you are unsure, use the regional support channel listed on the company's notice.
QAre passwords or credit cards affected?
The company says it has not confirmed any leak of CAPCOM ID passwords set by customers themselves. However, it confirmed that passwords on 196 accounts had been changed without authorization, and it has already reset them. The notice does not say how passwords are stored (for example, whether they are hashed). Credit card information was not among the affected data. The company has not asked customers to change their passwords.
QWhat caused it?
The company describes the cause as unauthorized access by a third party and says it has identified and addressed the attack method, but it has not disclosed what the method or route was. It says the investigation into the scope continues and that it will take measures to prevent recurrence based on the cause it identified. This is a different incident from the ransomware attack Capcom suffered in 2020.
QWhat if I get an email claiming to be Capcom?
The company warns that the leaked data could be misused to send fraudulent emails or other messages impersonating Capcom or related parties, and asks customers not to access URLs in them or open attachments. Because the company also plans to contact affected customers individually, do not log in through a link in an email; check on the official CAPCOM ID site or Capcom's notice page, opened yourself from a bookmark or a search.
QMy login email leaked. Is my account still safe?
CAPCOM ID logins use the registered email address and a password (according to the company's support page). The company says registered email addresses can continue to be used. But since the email used to log in is now known, if you use the same password on other services, it is safer to change it. CAPCOM ID lets you set up two-factor authentication from your Account page (support page). This is this site's general advice, not a request in the company's notice.