Capcom said on October 22, 2026 that a third party accessed customer information for 11,774,247 Capcom ID accounts on October 19, and warned players to watch for phishing attempts built on the exposed data.
What was exposed
According to Capcom’s disclosure, the accessed information includes email addresses as well as account-creation dates, last-login times, the number of logins and the IP address used during last login. The company said 43 of the affected accounts also had date of birth, gender, country or region and nickname accessed. Capcom said no credit card information was involved, and that passwords set by users themselves were not leaked.
Capcom said attackers were still able to change the passwords of 196 accounts without authorisation, and that it has already reset those passwords to stop the accounts being taken over. The company has reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission.
The phishing risk
Because email addresses were among the exposed data, Capcom told customers they may continue to use the email addresses registered with Capcom ID, but warned the affected information could be misused to send fraudulent emails pretending to come from the company.
“If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files,” Capcom said in its statement.
“Capcom takes this matter extremely seriously and will continue its detailed investigation. Based on the findings of the investigation, it will implement measures to prevent recurrence and further strengthen its information security framework,” the company said.
Capcom said it will notify users whose accounts were accessed, and that it does not expect its video games to be affected by the breach. It did not detail how it was hacked, but said it has completed emergency response measures and identified and addressed the attack method involved.
This is the second major data breach Capcom has suffered. In November 2020 it revealed a ransomware attack that stole hundreds of thousands of pieces of personal data from its servers, including the names and addresses of customers and former employees.
