Breach · · 3 min read
Capcom says 11,774,247 CAPCOM ID email records were copied
The October 22 notice says emails, login times and a last-login IP were in the copy. Passwords customers set were not confirmed stolen. Cards were not included.
Capcom says a third party got into CAPCOM ID, the account used for its websites and for playing some Capcom games online. Its notice of October 22, 2026 puts the copied email records at 11,774,247, a worldwide total. Credit cards were not in the copy. The games still launch, and CAPCOM ID still signs in.
What was copied
For those 11,774,247 records, Capcom lists the email address and what it calls system-specific identifier information: when the account was created, when it last signed in, how many times it has signed in, and the client IP address used for that last sign-in.
Two smaller sets sit inside that total, not on top of it:
- Date of birth, gender, country or region, and nickname: 43 records.
- Accounts whose CAPCOM ID password was changed without permission: 196. Capcom says it has already reset those passwords.
Capcom has not confirmed that the passwords customers themselves chose were copied. The 196 changes are a different fact. Someone changed those passwords. Capcom does not say it has finished measuring what those 196 accounts were used for after the change.
When Capcom found it
On October 19, Capcom saw activity that looked like unauthorized access to CAPCOM ID, started blocking it, and the same day confirmed the access had happened. It then worked on the method of attack. The notice says that method has been identified and addressed. It does not describe the method.
On October 20 the company stood up an incident headquarters, confirmed that some CAPCOM ID customer information had been accessed, confirmed the unauthorized password changes, and reported the matter to its external advisory body, the Information Technology Security Oversight Committee.
On October 21 it reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission. It says it is still monitoring, still investigating, and still measuring the full impact. It will write to affected customers. If it finds more that it has to disclose, it says it will post an update.
What to do
Capcom’s own warning is about what happens next, not about your card. The copied emails and last-login details can be used to send messages that look like Capcom. If a message is unexpected, do not open its links or its attachments.
- You do not need to change a password Capcom has not said was copied. The notice does not ask every CAPCOM ID holder to reset. It says the passwords customers set were not confirmed stolen.
- If you cannot sign in, do not use a link in an email to fix it. The 196 changed passwords were reset by Capcom. Open the support page yourself. Capcom lists this form for North, Central and South America, and the same form for Europe, the Middle East and Africa, plus feedback@capcom.com for that region. Asia outside Japan, and Oceania, are info-asia@capcom.com. The Japan line, 0120-801-271, runs 10:00 a.m. to 8:00 p.m. Japan time and is the Japan toll-free number, not a number to call from Canada.
- A real follow-up from Capcom will not need you to type a card number. Cards were not in the copied set. A message that asks for one is not this incident’s recovery step.
- The email address on the account can stay. Capcom says those addresses may continue to be used. The risk it names is fraudulent mail, not a dead account.
Media and investor calls go to Capcom’s public relations section in Osaka. That number is not the customer line.
Sources
- Capcom, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, October 22, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.