Capcom Data Breach: 11.7 Million CAPCOM ID Accounts Hit, What Was Taken and What to Do

The Capcom data breach affected 11,774,247 CAPCOM ID records worldwide, the Resident Evil and Street Fighter publisher confirmed on 22 October 2026. Email addresses and login details were taken, but Capcom says credit card information was not affected and it has found no sign that customers' own passwords were stolen.

The main risk now is phishing: fake emails, texts or calls pretending to be Capcom.

Capcom data breach at a glance

What happened in the Capcom breach?

Capcom says it spotted suspicious activity on 19 October, blocked the access and confirmed that a third party had got into CAPCOM ID systems. On 20 October it set up an incident response team and confirmed that customer information had been accessed and some passwords changed. On 21 October it reported the attack to the Osaka Prefectural Police and Japan's Personal Information Protection Commission, and it published its notice on 22 October.

Capcom says it has identified and dealt with the method of attack, and that the incident "does not affect players' ability to access or play any Capcom games".

What information was stolen?

• 11,774,247 records: email address plus account data: when the account was created, when it last logged in, how many times it has logged in, and the IP address used for the last login.
• 43 of those records also included date of birth, gender, country or region and nickname.
• 196 accounts had their passwords changed without permission. Capcom has reset them.

In an update on 23 October, Capcom said the attacker also opened the e-Capcom store pages of 19 of those 196 accounts, all in Japan. For those 19, name, phone number, postal address, gender, date of birth, purchase history, inquiry history and saved addresses were exposed. The other 177 hijacked accounts only had their password changed.

Were passwords or credit cards stolen?

Capcom says credit card information was not included, and it "has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves". The only password problem it found was the 196 accounts the attacker changed.

What should CAPCOM ID users do?

Capcom says email addresses registered with CAPCOM ID can keep being used. Its main advice is to watch out for scams, because the stolen data could be used to send messages pretending to be Capcom:

• Don't open links or attachments in unexpected emails, texts or calls claiming to be from Capcom.
• Log in to CAPCOM ID by typing the address yourself, not from an email link.
• If you used your CAPCOM ID password anywhere else, changing it is a sensible precaution (Capcom hasn't asked customers to, but it costs nothing).
• Capcom says it will contact affected customers directly.

How do I contact Capcom about the breach?

• Americas, Europe, Middle East and Africa: Capcom's support inquiry form at capcom-support.com (Europe can also email [email protected]).
• Asia (outside Japan) and Oceania: [email protected].
• Japan: a free support line on 0120-801-271, 10am to 8pm JST.

Has Capcom been hacked before?

Yes. In November 2020 Capcom was hit by a ransomware attack on its internal network, which exposed data on around 16,000 people, mostly business partners and staff. This new breach is different: it hit the CAPCOM ID customer account system and is far larger by number of records.

More gaming tech and security news on iGame Magazine

• Capcom Confirms Dragon’s Dogma 2 Update and PS5 Pro Patch: an older Capcom story
• Is the RTX 5090 Discontinued? NVIDIA Says No, but It’s Vanished From Shelves and Prices Have Hit $8,500: this month's big hardware story
• NVIDIA RTX Spark Laptops Are Out: Every Model, Price and What They Mean for Gaming: NVIDIA's new RTX Spark laptops

FAQ