More than 11.7 million CAPCOM ID accounts had customer email addresses and associated account information exposed, Capcom confirmed after detecting unauthorized access on October 19, 2026.
What Capcom says was taken from CAPCOM ID
In an alert, Capcom said the breach affected its shared account system, CAPCOM ID, which customers use to access web services and some online games. The company reported that exposed fields include customer email addresses, account creation dates, last-login timestamps, number of logins, and the IP address used at the last login.
Capcom identified two smaller subsets with additional exposure: 43 accounts had dates of birth, gender, nicknames, and countries included in the data accessed, and 196 accounts had their CAPCOM ID login passwords changed by the intruders in an apparent attempt to lock owners out. Capcom said it "took action and reset them."
According to the company, passwords for all other registered members were not exposed, and credit card information remained unaffected.
Timeline of detection, investigation, and reporting
Capcom detected suspicious activity and confirmed unauthorized access on October 19, 2026, and launched an investigation immediately. The company said that by the following day it was clear customer information had been compromised. Capcom reported the incident to the police and to Japan’s Personal Information Protection Commission on October 21.
Capcom also said its online services remain unaffected while the investigation proceeds, but it warned users to be vigilant for unsolicited communications and emails requesting additional information or messages containing URLs and attachments.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRemediations Capcom has taken and what it is communicating
During the investigation Capcom said it identified the intrusion method and implemented security measures to prevent similar incidents, though it has not shared details related to the initial access. The company will notify affected customers in stages—Capcom explained the phased approach is "likely due to the large volume of affected accounts"—and has established region-specific communication channels for support requests.
For the 196 accounts where attackers changed passwords, Capcom reset those accounts. Beyond that specific action the company reiterated that other members’ passwords were not exposed and that payment card data were not impacted.
What this means for end users, regulators, and security teams
- End users: Capcom explicitly cautioned customers to stay vigilant for unsolicited communications, including emails requesting additional information or messages that contain URLs and attachments.
- Regulators and law enforcement: Capcom reported the incident to the police and to Japan’s Personal Information Protection Commission on October 21; those bodies are now on the record as recipients of the company’s notification.
- Technologists and security teams: Capcom stated it identified the intrusion method and implemented measures, but did not disclose how initial access was gained—an action and a gap that security teams will note as they evaluate defensive posture and incident disclosures.
Historical context inside Capcom and a broader note
Capcom is the Japanese developer and publisher behind franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The company employs about 4,000 people and reports annual revenue of $1.24 billion. The firm has experienced public cyber incidents before: in November 2020 an attack claimed by the Ragnar Locker ransomware gang purportedly resulted in the theft of 1 TB of data and Capcom later warned as many as 390,000 people could be affected. In April 2021 the company disclosed attackers had gained access through an old VPN device.
The notification also included a reminder drawn from industry analysis: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026, cited in the alert, measures defenses technique by technique across 338 million simulations run in customer production environments.
Capcom’s confirmation fixes the scale of this incident—more than 11.7 million CAPCOM ID accounts—and establishes the visible remediation steps: password resets for the subset of 196 locked accounts, staged notifications to affected users, and unspecified security measures after the company said it identified the intrusion method. What remains unanswered in the company’s public statements is the route of initial access; Capcom says it has not shared those details. Customers can expect staged notices and region-specific support channels as the company works through the volume of affected accounts.
