# Capcom Data Breach Exposes 11.7 Million CAPCOM ID Accounts - URL: https://usa-24.com/capcom-id-data-breach/ - Publisher: USA 24 - Section: Cybersecurity - Published: 2026-10-26T20:01:38.395Z - Updated: 2026-10-26T20:01:38.399Z - Topics: Data Breach, Phishing, Capcom, Gaming Security, Account Security > Capcom says attackers reached CAPCOM ID accounts tied to Street Fighter and Resident Evil, exposing emails and login metadata. Capcom has warned players to watch for phishing. ## Key takeaways - Capcom detected suspicious activity on October 19 and said a third party gained unauthorized access to CAPCOM ID customer information. - The disclosed dataset covers 11,774,247 records worldwide, including email addresses and account metadata such as last-login IP. - Capcom says it found no evidence that customer-set passwords were compromised and that payment card information was not in the affected data. - Attackers changed passwords on 196 accounts without authorization, and Capcom has reset those accounts. - A notice dated October 23 put the maximum number of people potentially affected at about 390,000, a figure the reporting does not reconcile with the record count. Capcom's account system was breached, and the first public count is large: 11,774,247 records tied to CAPCOM ID, the sign-in account for its web services and some online games. The Capcom data breach was detected on October 19, disclosed in updated figures on October 22 and 23, and now carries a phishing warning aimed at players, including those in the United States. ## What the Capcom data breach exposed Capcom says a third party gained unauthorized access to customer information tied to CAPCOM ID, according to [Help Net Security](https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/). The company detected suspicious activity on October 19 and confirmed the intrusion the same day, according to [Notebookcheck](https://www.notebookcheck.net/Capcom-confirms-major-data-breach-affecting-more-than-11-7-million-Capcom-ID-accounts-worldwide.1431069.0.html). The core data is email addresses plus account metadata. Capcom's notice lists the creation date of each account, the last-login time, the login count and the last-login IP address, along with the email address. For 43 records, date of birth, gender, country or region, and nickname were also exposed. Two categories were not reported as compromised. Capcom says it found no evidence that customer-set passwords were compromised, and payment card information was not in the affected data. That limits what an attacker can do directly with the stolen records, but it does not make them harmless. Attackers did change passwords on 196 accounts without authorization. Capcom has reset those accounts, according to [GameDev News](https://gamedev.net/news/6660-capcom-affected-by-data-breach-over-117m-capcom-id-accounts-compromised/). Capcom has also apologized. [TechRadar](https://www.techradar.com/pro/security/capcom-data-breach-confirmed-around-11-7-million-accounts-thought-to-have-been-affected) quoted the company's machine-translated public notice: "We deeply apologize for the great inconvenience and concern caused to our customers and all stakeholders." No individual was named. ## Which players and accounts are affected Anyone who created a CAPCOM ID account could be in scope. CAPCOM ID is a free, unified account that lets users access a range of Capcom games and online services. TechRadar reports that it has more than 10 million users, and the accounts link to franchises including Street Fighter, Resident Evil and Monster Hunter. Accounts and people are not the same measure. Reports describe more than 11.7 million accounts in scope, but a notice dated October 23 put the maximum number of people potentially affected at about 390,000, as [Ginx reported](https://www.ginx.tv/en/capcom-data-breach-390000-people-11-7-million-capcom-id-accounts). The reporting does not explain the gap. Multiple entries for one person could account for part of it, but none of the sources I reviewed says so. I did not find a US-specific count in the reporting. Because Capcom is based in Japan, its formal reporting so far has gone to Japanese authorities. It notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21. Games and online services stayed available during the incident, according to [Windows Central](https://www.windowscentral.com/gaming/capcom-suffers-massive-data-breach-exposing-private-information-from-over-11-7-million-capcom-id-accounts-worldwide). ## Why stolen email addresses create a phishing problem Capcom's own warning focuses on phishing. The company said the stolen email addresses could be used to send fraudulent messages that pose as Capcom or related parties, as [HotHardware reported](https://hothardware.com/news/capcom-id-data-breach-october-2026). For American players, the likely threat is not a sudden drain on a bank account. It is a message that looks like a password reset, a security alert or a sign-in warning. The breach is narrower than one that exposes stored passwords or card numbers. That is why Capcom's advice centers on recognizing suspicious messages rather than on emergency account lockdowns. Pairing an email address with a password from a different breach is a standard way attackers take over accounts. That is general security reasoning, not a finding from the sources, but it explains why players who reused passwords face more risk than others. For a comparable case involving customer contact data, see our coverage of the [Genesys breach](https://usa-24.com/genesys-data-breach-customer-data/). ## How US players can protect their accounts These steps are general recommendations, not instructions from Capcom: - Treat unexpected emails that reference Capcom as suspect. Go to the official site by typing the address yourself instead of clicking a login link. - Change your CAPCOM ID password, and make sure it is not used on any other service. - Turn on two-factor authentication wherever CAPCOM ID offers it. - Review recent login activity and alerts, and act on any sign-in you do not recognize. - Treat any email that asks for a password, a payment or a verification code as a scam, even when it uses Capcom branding. I did not find a lookup tool in the reporting. Capcom's official notice is the place to confirm whether your account is included. ## Open questions in the Capcom breach Several basic facts are still missing from the reporting I reviewed. - How many US accounts are affected? None of the sources gives a figure. - How do 11.7 million records reconcile with about 390,000 potentially affected people? - Who carried out the intrusion, and how did they get in? The reporting does not name the threat actor or the method. Most of this comes from secondary coverage that quotes Capcom's notice. Readers should check the figures against the company's own site. ## What comes next for Capcom account holders The next useful signal is whether Capcom publishes a country-level breakdown, especially for the United States. A change to the 390,000 figure would also matter, because it would show how the company is counting exposure. Japanese authorities will likely shape the formal follow-up, so any regulatory outcome is more likely to come from Tokyo than Washington. Phishing is the more immediate test. If scam emails that use Capcom branding start circulating widely, that will show whether attackers have turned the stolen email list into an active campaign. Players should expect that wave to arrive before any final investigation report does. ## Frequently asked questions ### Is my CAPCOM ID account affected by the Capcom data breach? Capcom says anyone who created a CAPCOM ID account could be in scope. The exposed data includes email addresses and login metadata, but the company says payment card information was not in the affected data. The reporting I reviewed does not offer a lookup tool, so check Capcom's official notice. ### Did the Capcom breach expose passwords? Capcom says it found no evidence that customer-set passwords were compromised. Attackers did change passwords on 196 accounts without authorization, and Capcom has reset those accounts. Players who reused passwords elsewhere should still change them. ### Why does the Capcom breach say 11.7 million accounts but only 390,000 people? The 11,774,247 figure counts records, while a notice dated October 23 put the maximum number of people potentially affected at about 390,000. The sources do not explain the gap. Multiple entries for one person could be part of it, but that has not been confirmed. ### What should I do about a Capcom phishing email? Do not click login links in unsolicited messages. Type Capcom's official address yourself to sign in, and change your CAPCOM ID password if it matches any other account. Turn on two-factor authentication wherever it is offered. ## Sources 1. [Capcom data breach exposes 11.7 million account records — Help Net Security](https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/) 2. [Capcom suffers massive data breach exposing private information from over 11.7 million Capcom ID accounts worldwide — Windows Central](https://www.windowscentral.com/gaming/capcom-suffers-massive-data-breach-exposing-private-information-from-over-11-7-million-capcom-id-accounts-worldwide) 3. [Capcom data breach confirmed — around 11.7 million accounts thought to have been affected — TechRadar](https://www.techradar.com/pro/security/capcom-data-breach-confirmed-around-11-7-million-accounts-thought-to-have-been-affected) 4. [Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide — Notebookcheck](https://www.notebookcheck.net/Capcom-confirms-major-data-breach-affecting-more-than-11-7-million-Capcom-ID-accounts-worldwide.1431069.0.html) 5. [Capcom affected by data breach, over 11.7m Capcom ID accounts compromised — GameDev News](https://gamedev.net/news/6660-capcom-affected-by-data-breach-over-117m-capcom-id-accounts-compromised/) 6. [Capcom data breach: up to 390,000 people affected — Ginx](https://www.ginx.tv/en/capcom-data-breach-390000-people-11-7-million-capcom-id-accounts) 7. [Capcom Warns Gamers After Massive Breach Hits 11.7 Million Accounts — HotHardware](https://hothardware.com/news/capcom-id-data-breach-october-2026)