Capcom ID Data Breach: 11.77 Million Accounts Exposed — What Players Should Do Now

Image: Capcom (official image)

TL;DR — Capcom has confirmed a Capcom ID data breach affecting 11,774,247 accounts worldwide: an outsider accessed email addresses and account activity data, and changed the passwords of 196 accounts. Capcom says passwords set by users and credit-card data were NOT leaked, games remain playable, and the immediate risk is phishing emails impersonating Capcom.

📌 KEY HIGHLIGHTS

• Capcom confirmed the breach itself in an official press release on 22 October 2026 — the company's own disclosure, not a leak-site claim.
• 11,774,247 CAPCOM ID records were accessed worldwide: email addresses plus account creation date, last-login date, login counts and the IP address of the last login.
• Only 43 records also included date of birth, gender, country/region and nickname; 196 accounts had their passwords changed by the attacker — Capcom has already reset them.
• No evidence that passwords set by customers were leaked, and credit-card information was not included in the affected data.
• Services and games remain available; Capcom has reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.

What happened — the Capcom ID breach timeline

Date	What happened
19 Oct 2026	Capcom detects suspicious activity on CAPCOM ID, starts blocking the access and confirms the same day that unauthorised access occurred; emergency measures begin and the attack method is identified and addressed.
20 Oct 2026	Capcom sets up an internal incident-response headquarters and confirms that customer information was accessed and that a limited number of account passwords were changed without authorisation.
21 Oct 2026	Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
22 Oct 2026	Capcom publicly discloses the full known scale — 11,774,247 affected records — says emergency response is complete, and begins contacting affected customers.

The important precision: this is a confirmed account-data exposure on a very large scale, not a shutdown. CAPCOM ID is the free unified account needed for the online features of Capcom games such as Street Fighter 6, and playing its games is unaffected. The investigation is still running, so the numbers are "as of 22 October" and could be updated.

Image: Wikimedia Commons — arcade gamers (illustrative image), CC BY-SA 4.0

What data was exposed — and what was not

Confirmed exposed (11,774,247 records): email addresses and system-specific identifier information — account creation date/time, last-login date/time, login counts, and the client IP address of the last login. For 43 records, date of birth, gender, country/region and nickname were also accessed. Separately, the attacker changed the login passwords of 196 accounts; Capcom has reset them to prevent account takeover.

Not exposed, per Capcom: the passwords customers set themselves (no evidence they were compromised) and credit-card information, which was not among the affected data at all. Your registered email can keep being used — the danger is what a scammer can do with it.

Why it matters for World readers

Eleven million email addresses, each tied to a real gaming account with login history and an IP address, is prime material for convincing phishing: a fake "Capcom security alert" that mentions your account activity will look far more real than a generic scam — the same pattern readers saw this week in the SBI customer data leak on the dark web, where the confirmed risk was also phishing rather than direct theft. This is Capcom's second major breach, after a November 2020 ransomware attack stole data of customers and former employees. CAPCOM ID is used for online play in India, the US, Europe and Japan, so the exposure is genuinely worldwide.

Should you care?

✅ Yes — if you have a CAPCOM ID, care about phishing, not about your card or your saved password. Capcom says user-set passwords and credit-card data were not leaked, games and services are running, and only 196 accounts had passwords changed (already reset). ⏳ What is still missing: exactly how the attacker got in, and whether the investigation finds more affected data. Capcom says it will disclose additional facts promptly if they emerge — we will update this post if that happens.

What Capcom players should do now

• Treat every "Capcom" email as suspect. Do not click links or open attachments in messages about this breach — open the official Capcom site or your game directly instead, exactly as Capcom itself advises.
• Check your account. Log in to CAPCOM ID through the official site. If your password was one of the 196 changed and reset, complete Capcom's password-reset flow to regain access.
• Set a strong, unique password anyway. A fresh password you do not reuse anywhere else removes a whole class of risk.
• Watch your registered email — phishing may reference your account or login details to sound genuine. Details in an email do not prove it is from Capcom.
• Wait for Capcom's notification. Capcom says it will notify affected customers and has opened dedicated support channels in Japan, the Americas, EMEA and Asia/Oceania.

FAQs

How many accounts were affected in the Capcom ID data breach?
Capcom confirmed 11,774,247 CAPCOM ID records worldwide as of 22 October 2026. The records contain email addresses and account activity data; only 43 records also included date of birth, gender, country/region and nickname.

Were CAPCOM ID passwords leaked in the breach?
Capcom says it has not confirmed any compromise of the passwords customers set themselves. However, an attacker changed the passwords of 196 accounts without authorisation, and Capcom has already reset those passwords.

Was credit-card information leaked in the Capcom breach?
No. Capcom states clearly that credit-card information was not included among the affected information.

Can I still play Capcom games and use my registered email?
Yes. Capcom says it has completed its emergency response, CAPCOM ID services remain available, gameplay is unaffected, and registered email addresses can continue to be used — just stay alert for fraudulent emails impersonating Capcom.

TAKEAWAY
The Capcom ID data breach is real, company-confirmed and large — 11.77 million accounts — but what leaked is mainly email and account-activity data, not passwords or card details. Stay calm about your wallet, and stay sharp about every email that claims to be from Capcom.

Follow World Tech on TechByCountry for the next update.

Sources: Capcom (official press release) — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, 22 Oct 2026 • Video Games Chronicle — Capcom says a data breach affected more than 11 million Capcom ID accounts • AUTOMATON WEST — Capcom reports large-scale data breach affecting approximately 11.77 million CAPCOM ID accounts • Notebookcheck — Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide. Facts checked 22 Oct 2026; this post will be updated as Capcom's investigation reports.