Capcom ID Breach Exposes 11.7 Million Records Worldwide

Email addresses, login metadata, and last-used IP addresses were accessed

Capcom says unauthorized access to CAPCOM ID affected 11,774,247 records worldwide, creating an immediate risk of convincing phishing messages aimed at players.

Capcom confirmed the incident on October 22, 2026, after detecting suspicious activity three days earlier. The affected service is CAPCOM ID, the unified account used for several company web services and required for online play in certain Capcom games.

This is a confirmed compromise of the CAPCOM ID service. It is different from an individual account takeover such as the cases covered in our Roblox account recovery guide. Capcom says its games remain available and the incident does not prevent players from accessing or playing them.

Want more gaming security warnings that separate confirmed breaches from rumors?

Get factual security alerts, scam warnings, gaming news, interviews, and independent coverage from Fix Gaming Channel.

What information was affected

According to Capcom’s official notice, the 11,774,247 affected records include email addresses and system information: the date and time an account was created, the date and time of its last login, the number of logins, and the client IP address used for the last login.

Within that total, 43 records also included a date of birth, gender, country or region, and nickname. Capcom also confirmed that login passwords were changed without authorization on 196 accounts. Those passwords have been reset.

Capcom has not confirmed that passwords originally chosen by customers were exposed. Credit card information was not included among the affected data.

Why players should watch their inboxes

The immediate player risk is impersonation. Capcom warns that the exposed information could be misused for fraudulent emails or other messages pretending to come from the company or a related party.

Do not open attachments or follow links in a suspicious message. If an email claims there is a problem with your account, open the official CAPCOM ID website yourself or use Capcom support. This is especially important because convincing branded messages are already a recurring tactic in gaming account and phishing scams.

Capcom says the attack method has been addressed

Capcom detected the activity on October 19 and began blocking access while investigating. The company established an internal incident response headquarters on October 20, then reported the matter to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21.

The company says it has identified and addressed the method used in the attack and completed its emergency response measures. It is contacting affected customers, operating dedicated support channels, and continuing to investigate the full scope of the incident. No attacker identity or motive has been confirmed in the company’s notice.

Related Reading

Roblox Account Hacked? What to Do First

Steam and Discord Scams Are Getting Smarter in 2026

Gamers Beware: The History and Rising Threat of Gaming Viruses