Capcom breach exposed 11,774,247 CAPCOM ID records
Original title: Capcom Confirms Data Breach Exposing 11.7 Million CAPCOM ID Records
Only 43 records included birth date, gender, region and nickname; services stayed up after containment.
Capcom confirmed unauthorized access to its CAPCOM ID membership service, disclosed on October 22, 2026. The exposed set is 11,774,247 records of email addresses and system-specific identifiers such as creation time, last login, login count and last client IP. Forty-three records also included date of birth, gender, country or region and nickname, and 196 accounts had passwords changed without authorization. Capcom reset those passwords, said original customer passwords and credit cards were not confirmed compromised, and kept CAPCOM ID and games available. It warned the data could support phishing that impersonates Capcom and said it will contact affected customers.
Unconfirmed: Capcom says it addressed the attack method but has not disclosed initial access, vulnerabilities or attribution.
- Suspicious activity was detected on October 19 and containment began the same day.
- An internal response team and the external oversight committee were engaged on October 20.
- Police in Osaka and Japan's privacy commission were notified on October 21.
- The notice does not name a vulnerability, malware or an attacker.
- Capcom says registered email addresses can still be used.
Impact: Email addresses and account metadata for millions of CAPCOM ID users
| Product | Affected |
|---|---|
| CAPCOM ID | — |
- 1.Avoid links and attachments in messages impersonating Capcom or related organizations.
- Vendors
- Capcom
- Products
- CAPCOM ID
- Victims
- Capcom
- Organizations
- Osaka Prefectural PolicePersonal Information Protection CommissionInformation Technology Security Oversight Committee
- Countries
- Japan
From the original article
2 min read at gbhackers.com
Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. An unauthorized third party accessed customer information linked to its online membership service. This incident, disclosed on October 22, 2026, exposed email addresses and account metadata.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.