CAPCOM , the Capcom ID service holder for its online games and linked platform accounts, has disclosed a breach affecting more than 11.7 million CAPCOM ID records worldwide. The exposed data includes email addresses, account activity details and IP addresses, with a smaller subset containing personal information such as dates of birth.
Capcom said credit card information was not affected, and while it has not confirmed that customers’ passwords were originally compromised, 196 accounts had their passwords changed without authorisation and those passwords have been reset. The 11.7 million figure refers to affected records rather than a straightforward one-to-one count of users, and Capcom remains investigating the full impact and any additional unauthorised activity.
Capcom discovered the incident on 19 October 2026 and says it has addressed the attack method. The breach could make phishing messages more convincing, enabling scammers to imitate Capcom communications and solicit passwords or verification codes. The company emphasises that users should check their accounts, especially if they received an unexpected password-change notice, and to enable two-factor authentication on CAPCOM ID.
Guidance includes visiting the official Account page to review registered information and linked platform accounts, and using Capcom’s official breach notice or support channels for assistance. Players are advised to stay vigilant for urgent-looking messages and avoid following suspicious links or attachments. Capcom notes that services remain available while it continues to assess the incident.