11 Million Impacted by Capcom Data Breach

In October 2026, Capcom disclosed a data breach involving unauthorized access to its CAPCOM ID service. Attackers exfiltrated 11,774,247 email addresses along with account metadata including creation date, last login date, login count, and last login IP address. For a subset of 43 users, more sensitive personal data was accessed, including dates of birth, gender, country/region, and nicknames. Additionally, attackers changed the login passwords for 196 accounts, though no user passwords were stolen. Capcom responded by resetting the affected passwords, contacting impacted customers, and reporting the breach to relevant authorities. The company emphasized ongoing investigation and efforts to strengthen information security.

The breach exposed a large volume of email addresses and account metadata, which could facilitate phishing or targeted social engineering attacks. The compromise of personal details for a small subset of users increases privacy risks for those individuals. Unauthorized password changes affected 196 accounts, potentially disrupting user access and requiring password resets. No passwords were stolen, reducing the risk of direct credential misuse. The breach may damage user trust and require Capcom to enhance security controls.

Capcom has reset passwords for the 196 affected accounts and is contacting impacted users. Users are advised to be vigilant against phishing attempts impersonating Capcom or related entities. Capcom has reported the incident to authorities and is investigating the root cause to prevent recurrence. No further immediate user action is indicated beyond monitoring communications from Capcom and following password reset instructions if contacted.