Capcom confirms CAPCOM ID breach of 11.7 million accounts
October 23–24: Reports add a response headquarters on October 20, completed police and regulator notices by October 21, and a report to Capcom’s Security Oversight Committee.
Capcom says attackers accessed 11,774,247 CAPCOM ID records, mostly emails and login metadata, and reset 196 changed passwords.
Japanese game publisher Capcom confirmed unauthorized access to CAPCOM ID, its shared account service, after suspicious activity was detected and confirmed on October 19, 2026. Attackers obtained 11,774,247 records worldwide with email addresses plus account-creation dates, login counts, last-login times, and last-login IP addresses. Dates of birth, gender, country or region, and nickname were exposed for 43 accounts. Attackers changed passwords on 196 accounts, which Capcom reset; the company said stored passwords and payment cards were not compromised and kept services online. Capcom notified Osaka police and Japan’s privacy regulator, warned of impersonation emails, and has not described the intrusion method. No group has claimed responsibility.
- 11,774,247 records included emails and login metadata worldwide.
- Birth date, gender, region, and nickname were exposed for 43 accounts.
- Capcom reset 196 accounts after unauthorized password changes.
- Stored passwords and payment-card data were not confirmed stolen.
- Osaka police and Japan’s privacy commission were notified on October 21.
- No group has claimed responsibility; the method remains undescribed.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026Capcom detected and confirmed unauthorized CAPCOM ID access. · Infosecurity Magazine
- Oct 20, 2026Capcom set up an internal response headquarters. · Infosecurity Magazine
- Oct 21, 2026Capcom notified Osaka police and Japan’s privacy commission. · Help Net Security
- Oct 22, 2026Notice put exposed records at 11,774,247. · Infosecurity Magazine
What each outlet adds
beyond the shared facts- BleepingComputerFirst confirmation, staged notices, and phishing warning.
- SecurityWeekExact count and that stored passwords were not stolen.
- Help Net SecurityNo group claimed responsibility; method addressed but undescribed.
- Infosecurity MagazineResponse headquarters on October 20; measures finished October 21.
- Security AffairsCapcom also notified its Security Oversight Committee.
Coverage
oldest first · one row per article · UTC- · 6d ago
BleepingComputerFirst report
Nikkei discloses third breach in a month, 1.83 million records exposed
Stolen credentials opened a development system on October 7; 150,000 records held identifiers and no card data was exposed.
- · 5d ago
SecurityWeek
Nikkei says attackers stole 1.83 million cloud-service records
About 150,000 records held names and contact details; Nikkei says no card data or misuse was found.
- · 5d ago
Security Affairs
Nikkei says cloud breach leaked about 1.83 million records
Attackers used stolen credentials on October 7; about 150,000 records held identifying data and no card data was included.
- · 3d ago
Capcom confirms CAPCOM ID breach affecting 11.7 million accounts
Exposed data is mostly emails and login metadata; passwords and card data were not exposed for other members.
- · 2d ago
Capcom says breach exposed 11 million CAPCOM ID email addresses
Attackers also changed passwords on 196 accounts; Capcom says stored passwords were not stolen and those accounts were reset.
- · 2d ago
Help Net Security
Capcom breach exposes 11.7 million CAPCOM ID records
Stolen data is mostly emails and login metadata; Capcom found no customer passwords taken and reset 196 accounts.
- · 2d ago
Infosecurity Magazine
Capcom confirms breach of 11.7 million CAPCOM ID records
Exposed data is mostly emails and login metadata; 196 accounts had passwords changed, and card data was not taken.
- · 1d ago
Capcom breach exposes 11.7 million email addresses
Attackers also took account metadata and changed passwords on 196 CAPCOM ID accounts, which Capcom reset.