“The passwords associated with these accounts have already been reset, and the company continues to investigate the scope of any impact resulting from this incident,” Capcom said in a notice published October 22.
Scale and types of data accessed from CAPCOM ID
Capcom confirmed that customer information tied to CAPCOM ID — the unified account used to play Capcom-licensed games online and access related web services — was subject to unauthorized access by a third party. As of October 22, the company estimated the breach exposed 11,774,247 records consisting of email addresses and system-specific identifier information. The identifier information, the company said, can include date and time of account creation, date and time of last login, number of logins, and the client IP address used during the last login.
In addition to those records, Capcom reported a much smaller set of extremely sensitive personal details were accessed: 43 records containing date of birth, gender, country/region and nickname. Capcom has not confirmed that CAPCOM ID account login passwords originally set by customers were compromised, though it observed unauthorized password changes on 196 accounts and has reset those passwords.
Incident timeline: October 19–22, 2026
The company detected suspicious activity involving its CAPCOM ID account system on October 19, 2026, which indicated potential unauthorized access. Capcom said it immediately moved to block the access, investigate the cause and scope of the incident, and implement emergency response measures. Later that same day the company confirmed that unauthorized access had occurred and began identifying and addressing the attack method.
On October 20, Capcom established an internal incident response headquarters to coordinate the investigation and efforts to prevent further impact. The investigation determined that certain customer information registered with CAPCOM ID had been accessed without authorization, and that a limited number of account passwords had been changed without permission. By October 21, Capcom reported it had completed emergency response measures and identified and addressed the attack method.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleReporting to authorities and oversight bodies
Capcom reported the incident to multiple external bodies. The company said it had notified an external Information Technology Security Oversight Committee and reported the incident to the Osaka Prefectural Police as well as Japan’s Personal Information Protection Commission. In public communications, the company confirmed credit card information remains unaffected by the breach.
Service availability and customer guidance
Despite the incident, Capcom stated that services using CAPCOM ID, including its games, remain available. At the same time, the company warned that the affected information could be misused in fraudulent emails or other communications impersonating Capcom or related parties. Capcom advised customers to exercise caution when receiving suspicious messages and to avoid clicking on links or opening attachments originating from unexpected or unverified sources.
What this means for technologists, regulators, and end users
- Technologists and security teams: Capcom’s reporting that it identified and addressed the attack method and completed emergency response measures signals areas for technical review — namely the CAPCOM ID system components that were targeted and the specific vector the company addressed. Security teams will watch for any follow-up notices from Capcom about scope and residual access.
- Policymakers and regulators: The company’s notifications to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission place the incident squarely within the purview of Japanese authorities and oversight bodies that track breaches of personal data, and these bodies will receive Capcom’s findings as the company continues its investigation.
- End users and players: Players who use CAPCOM ID should note that Capcom observed unauthorized password changes on 196 accounts and has reset those passwords; the company also stated that credit card information was unaffected. Users were explicitly advised to be cautious of fraudulent communications and to avoid clicking links or opening attachments in suspicious messages.
Capcom’s public notice establishes a clear sequence: detection on October 19, emergency measures and incident-command steps the following days, targeted reporting to oversight bodies, and limited password resets for affected accounts. The company says it has identified and addressed the attack method and continues to investigate the scope of any remaining impact. For players and observers, the concrete facts are the numbers Capcom released — nearly 11.8 million records of contact and system identifiers, 43 records of more sensitive personal details, and 196 accounts with unauthorized password changes — and the company’s instruction to remain vigilant against fraud.
Read the original notice: https://www.infosecurity-magazine.com/news/capcom-confirms-data-breach/
