CAPCOM has disclosed a data breach affecting CAPCOM ID, its shared service used for online access and gaming. The incident was detected on 19 October 2026 and involved unauthorised access to CAPCOM ID. The attackers stole the email addresses of 11,774,247 people and retrieved account data such as account creation date, last login date, number of logins, and the last login’s IP address.
In a small subset of cases, 43 affected customers had additional personal details exposed, including dates of birth, gender, country/region, and nicknames. Capcom notes that no user passwords were themselves compromised, and it has reset passwords for the impacted accounts.
Regarding response and risk, Capcom says it has fully enacted incident‑response measures and that services using CAPCOM ID remained available. The firm has begun contacting affected customers and established a dedicated point of contact for inquiries. It has also notified relevant authorities and continues to investigate the incident. Capcom warns users to be cautious of unsolicited emails impersonating the company or related entities that contain suspicious URLs or attachments.
The company states it will conduct further surveys, take measures to prevent recurrence based on identified causes, and strengthen its information security system going forward.