Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Capcom confirms CAPCOM ID breach of 11,774,247 records

3 sources · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Capcom says unauthorized access exposed 11,774,247 CAPCOM ID records; 196 passwords were reset and services remain online.

Capcom confirmed unauthorized access to its CAPCOM ID membership service, disclosed on October 22, 2026, affecting 11,774,247 records worldwide. Exposed data includes email addresses and system identifiers such as account creation time, last login, login count and last client IP. Forty-three records also included date of birth, gender, country or region and nickname. Attackers changed passwords on 196 accounts, which Capcom reset; credit cards were not affected, and Capcom has not confirmed compromise of customers’ original passwords. CAPCOM ID and games remain available. The notice names no vulnerability, malware or attacker. Capcom says it addressed the attack method, will contact affected customers, and warns the data could support phishing impersonating Capcom, though no campaign is confirmed.

Key facts
  • 11,774,247 records exposed; the count is records, not necessarily unique users.
  • Forty-three records also held birth date, gender, region and nickname.
  • Passwords on 196 accounts were changed without authorization and then reset.
  • Credit cards were not affected; original passwords were not confirmed compromised.
  • No vulnerability, malware or attacker is named; registered emails can still be used.
  • CAPCOM ID can link to PlayStation, Xbox, Steam, Epic and Nintendo.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 19, 2026Suspicious activity detected; unauthorized access confirmed and containment began. · GBHackers
  2. Oct 20, 2026Internal response team and external oversight committee engaged. · GBHackers
  3. Oct 21, 2026Osaka police and Japan’s privacy commission notified. · GBHackers
  4. Oct 22, 2026Capcom publicly disclosed the CAPCOM ID breach. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersOctober 20 committee engagement and that registered emails remain usable.
  • Malwarebytes LabsRecords may not be unique users; attack method addressed; platform links.
  • Cyber Security NewsNo phishing campaign is confirmed; investigation continues with services up.
Vendors
Capcom
Products
CAPCOM ID
Victims
Capcom
Organizations
Osaka Prefectural PolicePersonal Information Protection CommissionInformation Technology Security Oversight Committee
Countries
Japan

Coverage

oldest first · one row per article · UTC
  1. · 2d ago GBHackersFirst report

    Capcom breach exposed 11,774,247 CAPCOM ID records

    Only 43 records included birth date, gender, region and nickname; services stayed up after containment.

  2. · 2d ago Malwarebytes Labs

    Capcom says 11.7 million CAPCOM ID records were exposed

    Emails, activity data and IP addresses leaked; passwords on 196 accounts were changed and then reset.

  3. · 2d ago Cyber Security News

    Capcom says unauthorized access exposed 11,774,247 customer records

    Exposed CAPCOM ID data includes emails and login activity; attackers changed passwords on 196 accounts, which Capcom reset.