Capcom Data Breach: 11.7 Million CAPCOM ID Accounts Exposed

Capcom has confirmed that unauthorized third-party access to its CAPCOM ID online membership system exposed email addresses and account metadata belonging to 11,774,247 accounts worldwide, with a smaller subset of 43 records also losing date of birth, gender, country/region, and nickname data, and 196 accounts having their passwords changed without authorization. The Japanese publisher behind Resident Evil, Street Fighter, and Monster Hunter disclosed the breach on October 22, 2026, said credit card information was not affected, and is now warning CAPCOM ID holders to watch for phishing emails that exploit the leaked addresses.

What Happened in the Capcom Data Breach

Capcom says it identified suspicious activity targeting CAPCOM ID, the single sign-on account system that ties together Capcom's web services and is required to access online features in a number of its games. According to Capcom's official notice, titled "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access," the company blocked the intruder's access as soon as it was detected and then spent several days confirming the scope of what had been taken.

The company says CAPCOM ID itself was never taken offline and that affected customers can continue using their existing email address to sign in and continue playing. That distinguishes this incident from a service outage — it is a data-exposure event centered on account records rather than a disruption to Capcom's games or storefronts.

Incident Timeline: How the Breach Unfolded

Capcom's notice lays out a tight, four-day sequence from detection to regulatory reporting:

That cadence — detect, contain, stand up an incident response team, notify an internal security oversight body, then report to police and the national privacy regulator, all within roughly 72 hours — is one of the faster disclosure timelines seen in a large-scale gaming-industry breach this year. Capcom says its investigation into exactly how the attacker got in is still ongoing.

What Data Was Exposed — and What Wasn't

Capcom's notice breaks the exposed data into two tiers by scale, and it is specific about the one high-value category that was not touched.

In other words, the overwhelming majority of the 11.7 million-plus affected accounts lost an email address plus behavioral metadata — not financial data, not a plaintext password, and not (for all but 43 accounts) personal profile details like date of birth or gender. Capcom has been explicit that it has not confirmed whether self-set account passwords were actually compromised in the attack; the 196-account figure specifically refers to accounts where Capcom observed an unauthorized password change, which it has already reversed by resetting those passwords.

That said, an exposed email address tied to confirmation that the address is a live, registered CAPCOM ID is itself useful to attackers — it is the raw material for targeted phishing, as discussed below.

The 196 Accounts With Unauthorized Password Changes

Of the nearly 11.8 million affected accounts, Capcom identified 196 where the account password had been changed without the owner's authorization — evidence that, for at least this small group, the intruder had working-level access to individual accounts rather than just a read of a database table. Capcom says it has already reset the passwords on all 196 accounts and is notifying those customers directly. The company has not said whether those 196 accounts saw any further activity, such as attempts to use linked platform accounts (PlayStation Network, Xbox, Steam, or Epic Games Store links are a standard part of CAPCOM ID), and its investigation is continuing.

How Capcom Is Responding

Capcom's notice lists a set of completed and in-progress measures:

• Containment: Capcom says it has completed its emergency response measures and identified the method of attack.
• Remediation: Passwords have been reset on all 196 affected accounts.
• Notification: Capcom is in the process of individually notifying affected customers and has opened dedicated support channels across Japan, the Americas, Europe/Middle East/Africa, and Asia-Oceania.
• Regulatory reporting: The incident has been reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
• Prevention: Capcom says it plans to strengthen its information security framework and implement measures to prevent recurrence, based on the findings of its ongoing investigation.
• Continued disclosure: The company says it will post further updates on its official site if additional facts come to light.

Capcom has not published a separate customer-facing FAQ page distinct from the notice itself as of this writing; the notice on capcom.co.jp functions as the primary reference document, and the company directs customers with questions to its regional support channels listed below rather than a self-service FAQ.

Why an Exposed Email List Is a Real Risk Even Without Passwords

It's tempting to read "no credit card data, no confirmed password compromise" and conclude the breach is low-stakes. That undersells it. A verified list of 11.7 million real, active email addresses that are confirmed to be tied to a specific video game publisher's account system is a ready-made target list for phishing campaigns impersonating that publisher. Attackers don't need your password to do damage — they need to know your email address is real, that you have a Capcom account, and roughly how old or active that account is (which the exposed login-count and last-login data also reveals).

Capcom itself flags this directly in its notice, warning that the leaked information "could be used to send fraudulent e-mails impersonating Capcom or related parties" and urging customers not to open links or attachments in suspicious messages. This pattern — large account databases leaking contact data that then fuels waves of impersonation email and SMS — has played out repeatedly in other recent breaches; Pandromeda's explainer on SMS phishing scams walks through how these impersonation campaigns typically work and how to spot them before they reach your personal details.

Phishing and Impersonation: What to Watch For

Because your CAPCOM ID email address is now confirmed-valid to whoever obtained the breached database, expect any of the following in the weeks ahead:

• Emails claiming to be from Capcom or CAPCOM ID support, asking you to "verify your account" or "reset your password" via an embedded link.
• Messages referencing specific Capcom games or CAPCOM ID features to appear more legitimate.
• Fake security-alert emails warning that your account was "compromised" and pushing you toward a lookalike login page designed to steal real credentials.
• Follow-on smishing (SMS phishing) if your phone number is linked to the same identity elsewhere.

Capcom's own guidance is straightforward: do not click links or open attachments in unsolicited messages claiming to be from Capcom, and verify any account-related request by navigating directly to the official CAPCOM ID portal yourself rather than through a link in an email. If you're unsure whether a message is genuine, Capcom's regional support channels (listed below) can confirm whether it actually sent you anything.

Password Reset and Account Security Advice

Capcom has not mandated a password reset for all 11.7 million affected accounts — only the 196 confirmed-compromised accounts had their passwords forcibly reset. Even so, security-minded CAPCOM ID holders should consider the following steps:

1. Change your CAPCOM ID password, especially if you reuse it anywhere else, by logging in directly at the official CAPCOM ID site rather than via an emailed link.
2. Check for password reuse. If your CAPCOM ID password is identical or similar to passwords on other services, change those too — exposed email-plus-metadata combinations are routinely fed into credential-stuffing attacks against other sites.
3. Enable two-factor authentication on CAPCOM ID if you haven't already, and on any platform accounts (PlayStation Network, Xbox, Steam, Epic Games) linked to it.
4. Treat unsolicited "Capcom" emails as suspicious by default. Don't click login links in email; type the URL yourself.
5. Watch your linked-platform accounts for unfamiliar activity, since CAPCOM ID can be connected to external storefronts and consoles.
6. Keep an eye on official Capcom channels for follow-up notices, since the company has said it will post further updates if its investigation turns up additional facts.

Capcom Support Channels by Region

Capcom has stood up region-specific support for customers with questions about the breach:

Putting the Scale in Context

At 11,774,247 affected records, this is among the larger single-company breaches disclosed this year, and it fits a pattern Pandromeda has tracked across several recent incidents: large platform account databases — not payment systems — are increasingly the target, because email addresses and login metadata are exactly what's needed to run convincing follow-on phishing at scale. We've seen similar dynamics in the Burger King Japan data breach, and the response playbook companies follow — contain, notify regulators, reset compromised credentials, warn customers about impersonation — tracks closely with what we outlined in our breakdown of what to do after a breach affecting a service you use.

Capcom is a Tokyo Stock Exchange-listed company (profiled in detail on Wikipedia) and one of the largest third-party game publishers in the world, making CAPCOM ID — used for everything from Monster Hunter crossplay to Resident Evil online features — a meaningful attack surface simply by virtue of its install base.

What CAPCOM ID Users Should Do Now

If you have ever created a CAPCOM ID — whether for Monster Hunter, Resident Evil, Street Fighter, or any other Capcom title with online features — treat your email address as exposed and act accordingly:

• Assume your email is now a phishing target. Be skeptical of any message claiming to be from Capcom, especially ones urging urgent action.
• Change your CAPCOM ID password directly through cid.capcom.com, particularly if you reuse it elsewhere.
• Turn on two-factor authentication wherever CAPCOM ID and linked platform accounts support it.
• Do not click links or download attachments in unsolicited "Capcom" emails; go to the official site directly instead.
• Contact your regional Capcom support channel if you receive a message you're unsure about, or if you believe your account was one of the 196 with an unauthorized password change.
• Follow Capcom's official notice page for updates, since the company has said it will disclose additional findings as its investigation continues.

For general guidance on recognizing phishing and impersonation attempts that follow a breach like this one, see CISA's phishing guidance for consumers and organizations.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage