Capcom Says Breach Exposed Data From 11.7 Million Accounts

Capcom has disclosed a data breach affecting Capcom ID that resulted in the exposure of data for about 11.7 million accounts. The incident, acknowledged on 22 October and reported publicly on 27 October 2026, involved a third party gaining unauthorized access to Capcom’s systems. The data obtained by the attacker included email addresses, account creation dates, last login times, the number of logins, and the IP address used during the last login.

In 43 cases, additional information such as date of birth, gender, country/region, and nickname was accessible. Capcom stated that passwords were not accessed; however, the attacker was able to change passwords for 196 accounts, and Capcom has reset those passwords to prevent account takeovers.

The report notes that the breach’s evidence and scope were reported by IXBT[.]games, with Capcom’s acknowledgement of the breach and the specific data elements affected. Capcom described the incident as the result of unauthorized access by a third party and apologised for the inconvenience and concern caused to affected users.

Capcom has taken steps to mitigate immediate risk by resetting passwords for compromised accounts, but the article does not specify further containment or remediation actions beyond these measures. The information is sourced from IXBT[.]games and Capcom’s public statement as reflected in the linked report.