TL;DR: The Capcom data breach confirmed on October 22, 2026, hit 11,774,247 CAPCOM ID records worldwide. For those records an outsider got the email address plus login metadata: when the account was created, when it last logged in, how many times it has logged in, and the IP address used at the last login. For just 43 records, date of birth, gender, country/region and nickname were also exposed. Attackers changed the password on 196 accounts, and Capcom has reset those. Capcom says it found no sign that customer-set passwords leaked, no credit card data was involved, and games and CAPCOM ID keep working. Update (Oct 23): 19 of the 196 hijacked accounts also had their e-Capcom (Capcom’s Japan-only online store) pages accessed, exposing name, phone number, home address, date of birth and purchase history for those 19 people in Japan. Capcom says its investigation into the scope is now complete. The real risk for most players is phishing emails pretending to be Capcom. To be safe, change your CAPCOM ID password (and anywhere you reused it), turn on CAPCOM ID two-factor authentication, check your linked PlayStation, Xbox, Steam, Epic and Nintendo accounts, and don’t click links in “Capcom” emails.
Last updated: October 24, 2026. By Veer. Facts checked against Capcom’s October 23, 2026 update, its October 22, 2026 notice (English translation of the Japanese original), the CAPCOM ID support FAQ, Capcom’s April 2021 final report on its 2020 ransomware attack, the Have I Been Pwned breach API, and reporting by The Verge, PCMag, CyberInsider and GamesRadar+. This is a researched explainer, not an analysis of the attack itself.
Update (October 24, 2026): In an October 23 follow-up, Capcom said an attacker used 19 of the 196 hijacked CAPCOM ID accounts to open their e-Capcom account pages. e-Capcom is Capcom’s online store in Japan. For those 19 records (Japan), the exposed data was name, name in Japanese phonetic characters, phone number, postal code, address, gender, date of birth, purchase history, e-Capcom customer inquiry history and saved address book entries. Card data wasn’t included. Capcom says it found no other data compromised through the password changes, that “the investigation into the scope of the impact from this incident has been completed,” and that it will keep monitoring CAPCOM ID. It also warned that the data could be used in fake texts, phone calls or other messages impersonating Capcom. The headline count is unchanged at 11,774,247 records.
What happened in the Capcom data breach?
Capcom says an unauthorized third party got into CAPCOM ID, the free account system the company uses for its websites and for online play in some of its games. The Japanese publisher behind Resident Evil, Monster Hunter and Street Fighter announced it in a press release dated October 22, 2026.
According to Capcom’s timeline:
- October 19, 2026: Capcom detected suspicious activity, began blocking the access and confirmed the same day that unauthorized access had happened.
- October 20: It set up an internal incident response headquarters, confirmed customer data had been accessed and that passwords on “a limited number of accounts” had been changed, and reported to its external Information Technology Security Oversight Committee.
- October 21: It reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
- October 22: It published the notice with the affected-record counts.
Capcom says it “has identified and addressed the attack method,” but it hasn’t said what that method was, when the access began or who was behind it. CyberInsider notes that the notice doesn’t explain how the attackers got in or how they were able to change passwords. Capcom’s October 23 follow-up covered the hijacked accounts (see below) but still didn’t name the attack method.
What information was exposed?
The exposure falls into three tiers. Capcom’s main figures are “as of October 22.” Its October 23 update added the e-Capcom row below and said the scope investigation is complete.
| What was exposed | How many | Notes |
|---|---|---|
| Email address + account metadata (account creation date/time, last login date/time, number of logins, IP address used at last login) | 11,774,247 records (worldwide) | This is the big one. Your email is your CAPCOM ID login name |
| Date of birth, gender, country/region, nickname | 43 records (a subset of the above) | Tiny group, but more personal data |
| Password changed without authorization | 196 accounts (a subset of the above) | Capcom says it has reset these passwords |
| e-Capcom store account data: name (incl. Japanese phonetic name), phone number, postal code, address, gender, date of birth, purchase history, e-Capcom inquiry history, saved address book | 19 records (Japan; a subset of the 196) | Added in Capcom’s October 23 update. Capcom will notify these customers |
| Passwords set by customers | No compromise confirmed | Capcom’s wording: it “has not confirmed” any compromise |
| Credit card information | Not included | Capcom says card data wasn’t among the affected information |
Two details matter more than they look:
- Your email address is your CAPCOM ID username. The CAPCOM ID FAQ says “Your ID is the email address used to register your account.” So the leak hands attackers a list of valid logins. They’d still need the password, but that’s exactly what password-reuse and phishing attacks go after.
- The last-login IP address can reveal your rough location and internet provider. It isn’t enough to break into anything on its own, but it can make a phishing email look more convincing (“we noticed a login from [your city]”).
“Has not confirmed any compromise” of passwords is a statement about what Capcom has found so far, not a guarantee. The fact that attackers were able to change 196 passwords shows they had some way to take over accounts, so changing your password is cheap insurance.
Was my CAPCOM ID affected?
If you have a CAPCOM ID, assume you may be in it. 11.77 million records is a very large share of the service, and Capcom hasn’t published a lookup tool. It says that “going forward, Capcom will notify customers affected by this incident.”
A few practical checks:
- Do you have a CAPCOM ID? You’d have created one to play certain Capcom games online or to use Capcom’s web services. PCMag lists the digital store and the Street Fighter 6, Monster Hunter and Resident Evil franchises among the places it’s used. Search your inbox for the sign-up email from Capcom.
- Watch for Capcom’s notification, but be careful: a breach notice is the perfect phishing cover. Don’t click links in it. Go to cid.capcom.com by typing the address yourself.
- Have I Been Pwned: when we queried the Have I Been Pwned breach API on October 23 and again on October 24, 2026, it had no Capcom entry. HIBP only lists breaches once it gets hold of the data, so an empty result doesn’t mean you’re safe. If it’s added later, the site will show it.
What should Capcom players do now?
Do these in order. Steps 1–3 take about ten minutes.
1. Change your CAPCOM ID password
Change it now, even though Capcom says customer passwords weren’t confirmed stolen. Log in at cid.capcom.com and change it from your Account page. If you can’t log in, use “Forgot your password?” on the log-in page, which the CAPCOM ID FAQ says will let you reset it. Use a long, unique password, ideally generated by a password manager.
If you were one of the 196 accounts whose password was changed, Capcom says it has already reset it. You’ll need to go through the reset flow to set a new one.
2. Change the same password anywhere else you used it
This matters more than step 1 for most people. Attackers now have 11.77 million confirmed email addresses. If any of those people reuse a password that leaked from some other site, attackers can try that pair on Steam, PlayStation, Xbox, email and banking accounts. If your CAPCOM ID password is the same as your email or platform password, change those first.
3. Turn on CAPCOM ID two-factor authentication
CAPCOM ID supports app-based two-factor authentication (2FA). According to Capcom’s support page, you set it up from your Account page with a smartphone or tablet and an authenticator app. Capcom names Google Authenticator and Microsoft Authenticator. Once it’s on, a stolen password alone won’t get anyone into your account.
One catch from the same FAQ: cancel 2FA on your old phone before switching to a new one. Otherwise “you will not be able to log in on your new device.” App-based codes are also stronger than SMS codes; our guide to whether SMS 2FA is safe explains why.
4. Check your linked platform accounts
CAPCOM ID can be linked to PlayStation, Xbox network, Steam, Epic Games and Nintendo accounts. You can see these under “Platform Account Information” on your Account page, per the support FAQ. Make sure every linked account is one you recognize, and unlink anything you don’t. Then make sure each of those platform accounts has its own unique password and 2FA. Where a platform offers passkeys, they’re even harder to phish.
5. Treat every “Capcom” email as suspect for the next few months
Phishing is the main risk Capcom itself warns about. Its notice says the leaked information “could be misused to send fraudulent emails or other communications impersonating Capcom or related parties,” and asks customers not to open links or attachments in suspicious messages. Expect lures like:
- “Your CAPCOM ID was affected. Verify your account here.”
- “Claim your compensation / free in-game items for the breach.”
- “Unusual login from [IP address or city]. Reset your password.”
- Fake Steam, PlayStation or Xbox security alerts sent to the same email address.
Capcom hasn’t announced any compensation, so a message offering it is a red flag. If an email asks for your password, a 2FA code or card details, delete it.
6. Should you delete your CAPCOM ID?
Only if you no longer use it. Deleting won’t undo this breach, because the data is already out. But an unused account is one less thing that can be taken over later. The FAQ says account deletion erases all account data and personal information and can’t be undone, so check you don’t need it for games you still play online first.
What should I do if I can’t log in?
Use “Forgot your password?” first, then contact Capcom support. If an attacker changed your password and also changed your account email, a reset may not reach you. Capcom lists dedicated support channels for this incident in its notice:
| Region | Where to contact Capcom |
|---|---|
| North, Central and South America | Capcom USA Customer Support inquiry form |
| Europe, Middle East and Africa (including the UK) | Capcom Europe Customer Support: same inquiry form or feedback@capcom.com |
| Asia (excluding Japan) and Oceania | info-asia@capcom.com |
| Japan | Toll-free 0120-801-271, 10 a.m. to 8 p.m. JST |
Type these addresses yourself rather than replying to any email that claims to be from Capcom.
Is my credit card at risk?
Capcom says no card data was involved. Its notice states that “credit card information was not included among the affected information.” That’s consistent with how Capcom described its systems after the 2020 attack. Its 2021 report said online transactions are “handled by a third-party service provider on a separate system” and that Capcom doesn’t keep card data internally.
You don’t need to cancel cards over this breach. If you saved a card on a linked platform such as PlayStation, Xbox or Steam, keep an eye on those statements anyway, since those are the accounts a phisher would go after next.
Has Capcom been breached before?
Yes. In late 2020 Capcom was hit by a Ragnar Locker ransomware attack, but that was a different kind of incident. Capcom first announced it on November 4, 2020. Its final report from April 13, 2021 says attackers got into its internal network through an older backup VPN device at its North American subsidiary, Capcom U.S.A., and that 15,649 people’s information was verified as compromised.
| 2020 ransomware attack | October 2026 CAPCOM ID breach | |
|---|---|---|
| What was hit | Internal company network (Japan and US offices) | CAPCOM ID customer account system |
| Who claimed it | Ragnar Locker ransomware group | Not disclosed |
| Confirmed people/records | 15,649 people (final count, April 2021) | 11,774,247 records (as of Oct 22, 2026) |
| Card data | Not involved | Not involved |
| How attackers got in | Old backup VPN device at Capcom U.S.A. | Not disclosed; Capcom says it’s been addressed |
The 2026 breach is far bigger by record count, but for almost everyone the data involved is an email address plus login metadata.
How does this compare with other recent breaches?
It’s broad but light. The Citizens Bank data breach this week involved Social Security numbers, the ETS data breach exposed students’ records, and the Quest Diagnostics data breach exposed patient records. Those call for credit freezes or closer account monitoring. The Capcom leak mostly exposed email addresses and login data, so the fixes are password hygiene, 2FA and phishing caution, not credit monitoring. Capcom hasn’t offered identity protection, and based on what it says was exposed, there’s no obvious need for it.
Capcom data breach timeline
| Date (2026) | Event |
|---|---|
| October 19 | Capcom detects suspicious activity on CAPCOM ID, blocks access, confirms unauthorized access the same day |
| October 20 | Incident response headquarters set up; customer data access and unauthorized password changes confirmed; external security committee notified |
| October 21 | Reported to Osaka Prefectural Police and Japan’s Personal Information Protection Commission |
| October 22 | Capcom publishes notice: 11,774,247 records, 43 with extra profile data, 196 passwords changed |
| October 23 | Capcom update: 19 of the 196 hijacked accounts had e-Capcom (Japan store) pages accessed, exposing name, address, phone, date of birth and purchase history; scope investigation completed |
| October 24 | Still no Have I Been Pwned listing when we checked |
We’ll update this post if Capcom publishes the attack method or notification details, or if the data shows up in breach databases.
FAQ
What was exposed in the Capcom data breach?
Email addresses and login metadata for 11,774,247 CAPCOM ID records: account creation date and time, last login date and time, number of logins, and the IP address used at the last login. For 43 records, date of birth, gender, country/region and nickname were also exposed. In an October 23 update, Capcom added that 19 hijacked accounts in Japan had e-Capcom store data exposed, including name, address, phone number, date of birth and purchase history. Capcom says no credit card data was involved.
Were CAPCOM ID passwords stolen?
Capcom says it has not confirmed any compromise of passwords set by customers. However, attackers changed the passwords on 196 accounts without authorization, and Capcom has reset those. Changing your CAPCOM ID password and turning on two-factor authentication is still a good idea.
How do I know if my CAPCOM ID was affected?
Capcom hasn’t released a lookup tool. It says it will notify affected customers. With 11.77 million records involved, anyone with a CAPCOM ID should assume they may be affected. Don’t click links in breach notification emails; go to cid.capcom.com directly.
Does CAPCOM ID have two-factor authentication?
Yes. You can turn on two-factor authentication from your CAPCOM ID Account page using a smartphone or tablet and an authenticator app such as Google Authenticator or Microsoft Authenticator. Cancel it on your old device before switching phones, or you won’t be able to log in on the new one.
Can I still play Capcom games after the breach?
Yes. Capcom says services that use CAPCOM ID remain available and the incident doesn’t affect players’ ability to access or play any of its games.
Is Capcom offering compensation or credit monitoring?
No. Capcom’s October 22 notice and October 23 update don’t mention compensation, free items or credit monitoring. Any email offering breach compensation or rewards in Capcom’s name should be treated as phishing.
Sources
- Capcom: Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (October 22, 2026; English translation, Japanese original prevails)
- Capcom: Update to Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (October 23, 2026; English translation, Japanese original prevails)
- CAPCOM ID: Support FAQ (login ID, password reset, two-factor authentication, platform linking, account deletion; checked October 23, 2026)
- Capcom: 4th Update Regarding Data Security Incident Due to Unauthorized Access: Investigation Results (April 13, 2021)
- Have I Been Pwned (breach API queried for capcom.com on October 23, 2026: no entry)
- The Verge: Capcom data breach leaks over 11 million email addresses (October 22, 2026)
- PCMag: Capcom Suffers a Breach Affecting 11.7 Million Accounts (updated October 23, 2026)
- CyberInsider: Capcom discloses data breach affecting 11.7 million accounts worldwide (October 22, 2026)
- GamesRadar+: Capcom confirms breach of 11.7 million ID accounts (October 2026)
