VULNpocalypse
MediumBreach / campaignMonitoring

Capcom breach: 11.7 million CAPCOM ID emails exposed, 196 accounts hijacked

Capcom says attackers reached CAPCOM ID data for 11,774,247 accounts on 19 Oct 2026 and hijacked 196 of them; 19 e-Capcom profiles were viewed. No card data.

Published
Updated
Exploitation
Yes. Unauthorized access confirmed on 19 October 2026; passwords changed on 196 accounts

What happened

Capcom published a notice on 22 October 2026 saying a third party had gained unauthorized access to CAPCOM ID, the account used for Capcom web services and some online games (Capcom, Japanese notice; Capcom, English notice).

Timeline, from Capcom’s notices:

  • 19 October: Capcom found suspicious traces, blocked the access, began investigating and confirmed unauthorized access the same day (Capcom).
  • 20 October: an internal response headquarters was set up. Capcom confirmed that customer data had leaked and that passwords had been changed on some accounts (Capcom).
  • 21 October: Capcom reported the incident to the police and to Japan’s Personal Information Protection Commission (Capcom).
  • 22 October: public notice and apology.
  • 23 October: Capcom said the investigation into the scope of the incident was complete, and that it continues to monitor CAPCOM ID and related services (Capcom update; INCIBE-CERT).

What was taken:

GroupAccountsData
All affected CAPCOM ID accounts, worldwide11,774,247Email address, account creation date and time, last login date and time, login count, IP address at last login
A subset43Also date of birth, gender, country or region, nickname
Accounts where the attacker changed the password196Capcom reset these accounts
Of those 196, e-Capcom (Capcom’s online store in Japan) account pages viewed19, all in JapanName, name in phonetic characters, phone number, postal code, address, gender, date of birth, purchase history, e-Capcom inquiry history, saved address book

Sources: Capcom, 22 October and Capcom, 23 October. For the other 177 hijacked accounts Capcom found no information compromised as a result of the password change.

What was not taken, per Capcom: credit card information, and “passwords set by customers themselves” have not been confirmed as leaked. Capcom says its games are unaffected and CAPCOM ID remains in service (Capcom).

How the attacker got in: not disclosed. Capcom says it has identified and dealt with the attack method but has not described it (Capcom; BleepingComputer). No group has been named or has claimed the attack in the sources we read.

This is not Capcom’s first incident. In November 2020 the Ragnar Locker group claimed to have stolen 1 TB of data, and in April 2021 Capcom said the attackers had entered through an old VPN device (BleepingComputer). Nothing links the two incidents.

Am I affected?

  • You have a CAPCOM ID: assume your email address, account dates, login count and last-login IP are in the leaked set. Capcom says it is contacting affected customers individually, in stages (Capcom).
  • You cannot sign in with your own password: you may be one of the 196 accounts whose password the attacker changed. Capcom says it has reset those accounts. Contact Capcom through your region’s channel below.
  • You shop on e-Capcom in Japan: if your CAPCOM ID was one of the 19 whose store pages were viewed, your name, address, phone number, purchase history and saved address book were exposed. Capcom says it will notify those customers.

What to do now

  1. Use only Capcom’s published support channels (Capcom update): - Japan: CAPCOM ID incident support line, 0120-801-271 (toll free), 10:00 to 20:00 JST. - North, Central and South America, and Europe, Middle East and Africa: the inquiry form at capcom-support.com, or feedback@capcom.com for EMEA. - Asia (excluding Japan) and Oceania: info-asia@capcom.com.
  2. Expect phishing that quotes real account details. The leak pairs your email with your account creation date and login history, which a phisher can quote to sound genuine. Capcom’s own advice is not to open links or attachments in unexpected messages that claim to be from Capcom (Capcom). Since Capcom says it is sending notifications, open its genuine notice by typing capcom.co.jp yourself rather than following a link in an email.
  3. e-Capcom customers in Japan: Capcom warns that the exposed data could be used in fraudulent texts or phone calls impersonating Capcom (Capcom update). Do not confirm details to a caller; call the 0120-801-271 line yourself.
  4. If you run a shared account system for several services: in this incident a password change on a central ID led straight to a store profile with home addresses and purchase history for 19 accounts. Require a fresh login and a confirmation to the old email address before a newly changed password can open pages that show addresses or order history, and alert on bursts of password changes from new IP addresses.

Sources