Capcom Confirms a Breach of 11.77 Million CAPCOM ID Records, With 196 Passwords Changed

Capcom has confirmed that attackers took data from 11,774,247 email-linked CAPCOM ID records, one of the larger player-account breaches in games this year. The company says no credit card data was affected and that its services remain online.

What Capcom disclosed

The notice on Capcom's investor relations site is dated October 22. It says suspicious activity was detected on October 19, then blocked and confirmed. An incident headquarters was set up on October 20, and the matter was reported on October 21 to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.

The exposed records are linked to email addresses and span players worldwide. Capcom lists the data involved as email address, account creation date and time, last login date and time, login count and the IP address used at the last login. In a much smaller group of 43 records, the data also includes date of birth, gender, country or region and nickname.

BleepingComputer, Help Net Security and Push Square all report the same figures. Headlines round the number to 11.7 million, but the exact count in Capcom's notice is 11,774,247.

Item	What Capcom says
Records exposed	11,774,247 email-linked CAPCOM ID records
Records with extra personal data	43 (date of birth, gender, country or region, nickname)
Accounts with unauthorised password changes	196, reset by Capcom
Credit card data	Not affected
Detected	October 19
Reported to authorities	October 21, Osaka Prefectural Police and Japan's PPC

The 196 accounts

The most worrying detail is that 196 accounts had their passwords changed without the owners' authorisation. Capcom says it has reset those accounts. It has not confirmed that passwords chosen by users were stolen, which is an important limit on what is known. The notice does not explain how the attackers got in, and Capcom has not named a method.

Changing a password is an action that requires access to the account system, not just a copy of a database. That suggests the attacker had more than read access, though Capcom has not drawn that conclusion publicly, and we are not drawing it for the company.

Who is behind it

No group has claimed responsibility, according to Help Net Security, and BleepingComputer saw no extortion claim at the time of writing. That can change. Data from breaches often surfaces later on criminal forums, sometimes weeks afterwards. Older Capcom incidents, including a 2020 ransomware attack, are separate events and should not be confused with this one.

What players should do

Capcom says it will contact affected users directly and warns that phishing is likely. The practical advice is simple. Treat any email that claims to come from Capcom with suspicion, especially one that asks you to log in through a link or to confirm payment details. Go to the official site by typing the address yourself.

If you reuse a CAPCOM ID password anywhere else, change it on those other sites now, because login details from one service are routinely tried against others. Use a password manager to give each account a unique password, and switch on two-step verification wherever it is offered. Since email addresses and last-login IP addresses were part of the data, expect more targeted spam even if your password was never taken.

What is still unknown

Capcom has not said how many of the 11.77 million records are active accounts, how the intruders gained access, or whether the stolen data includes anything tied to its Steam, console or mobile storefronts beyond the CAPCOM ID itself. It has also not said whether any players in a particular region were more affected than others. The 43 records with birth dates and gender are a small share, but they are the ones with the greatest risk of identity-based fraud.

What to watch next

Watch for a follow-up notice from Capcom with technical findings, any claim of responsibility, and whether the stolen records appear for sale. A regulatory response from Japan's Personal Information Protection Commission is also possible, since the company reported the incident to it.

Published October 25, 2026. Gadgets365 will update this article as more information becomes available.