Capcom ID breach exposes 11.7 million emails; 196 passwords reset
First merged summary.
Capcom says a Capcom ID breach leaked 11,774,247 emails and login metadata, and it reset 196 passwords the attacker changed.
Capcom said unauthorized access to its CAPCOM ID service, discovered on October 19, leaked customer information. As of October 22, 11,774,247 email addresses and system identifiers were taken, along with account creation dates, last-login dates, login counts, and latest-login IP addresses. In 43 cases, date of birth, gender, country or region, and nickname were also exposed. According to Capcom, stored passwords were not obtained, but the attacker changed passwords on 196 accounts, which Capcom reset. Capcom kept CAPCOM ID running, notified authorities, reported the incident the same day to its Security Oversight Committee, and warned customers about phishing emails impersonating Capcom or partners.
- 11,774,247 email addresses and system identifiers were taken.
- 43 accounts also had birth date, gender, region, and nickname exposed.
- Stored passwords were not obtained; 196 changed passwords were reset.
- Capcom discovered the access on October 19 and acknowledged it on October 22.
- CAPCOM ID stayed online; authorities and Capcom’s oversight committee were notified.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026Capcom discovers unauthorized access to CAPCOM ID. · Security Affairs
- Oct 22, 2026Capcom reports 11,774,247 emails taken and resets 196 passwords. · Security Affairs
What each outlet adds
beyond the shared facts- Security AffairsExact email count, discovery date, oversight notice, and phishing warning.
- DataBreaches.netStates stored passwords were not obtained despite 196 changes.
Coverage
oldest first · one row per article · UTCCapcom breach exposes 11.7 million email addresses
Attackers also took account metadata and changed passwords on 196 CAPCOM ID accounts, which Capcom reset.
Capcom says breach exposed data from 11.7 million Capcom ID accounts
The attacker changed passwords on 196 accounts even though stored passwords were not accessed.