Summary
Capcom says unauthorised access involved 11,774,247 CAPCOM ID records worldwide. The company also confirmed unauthorised password changes on 196 accounts and said credit-card information was not among the affected data.
Capcom says a third party gained unauthorised access to information associated with its CAPCOM ID online account service. In a notice dated 22 October 2026, the company reported 11,774,247 affected records worldwide. That is a record count, not a stated count of unique customers.
The affected information included email addresses and system-specific account details. Capcom said it had also confirmed unauthorised password changes on 196 accounts. It has not confirmed that customers’ originally set login passwords were compromised.
What information was affected
The 11,774,247 records included email addresses and identifiers such as account creation and last-login dates and times, login counts, and the client IP address used at the last login. Within that total, 43 records also contained a date of birth, gender, country or region, and nickname.
Capcom said credit-card information was not among the affected data. The company reset the passwords associated with the 196 accounts where unauthorised changes were found. It said its investigation into the incident’s full scope was continuing.
CAPCOM ID is a unified account for accessing Capcom web services and is required to play certain of the company’s games online. Capcom said services using the account remained available and the incident had not affected players’ ability to access or play its games.
Capcom’s response and customer guidance
The company detected suspicious activity on 19 October and confirmed unauthorised access that day. It said it blocked access, investigated the cause and scope, and identified and addressed the attack method. Capcom reported the incident to Osaka Prefectural Police and Japan’s Personal Information Protection Commission on 21 October. It said it would contact affected customers and continue investigating.
Capcom warned that the exposed information could be misused in fraudulent emails or other messages impersonating the company or related parties. It advises customers to avoid opening links or attachments in suspicious messages. Email addresses registered with CAPCOM ID can continue to be used, according to the notice.
For customers in Asia excluding Japan and in Oceania, Capcom lists [email protected] for inquiries. The company also provided separate support channels for Japan, the Americas, and Europe, the Middle East and Africa.