Capcom has confirmed that a third party accessed 11,774,247 CAPCOM ID records worldwide, exposing email addresses and login metadata, and changed the passwords on 196 accounts. In a notice on its investor relations site, the company says credit card information wasn’t among the affected data, and that games and services that use CAPCOM ID remain available. For players in the UAE, Saudi Arabia and Egypt, the practical risk is phishing rather than lost money.
What was accessed
CAPCOM ID is the unified account needed to use Capcom’s web services and to play certain Capcom games online. Video Games Chronicle lists Street Fighter 6 among them. Across the 11,774,247 records, the exposed data covers the registered email address, the date and time the account was created, the date and time of the last login, the number of logins, and the IP address used for that last login.
A much smaller group was hit harder. Of the total, 43 records also included date of birth, gender, country or region, and nickname. Capcom says it will contact affected customers directly.
Passwords: 196 accounts changed
Capcom says it hasn’t confirmed any compromise of the passwords customers originally set. It did confirm that passwords on 196 accounts were changed without authorisation, which suggests the intruder could modify account records, not just read them. Capcom has already reset those 196 passwords and says it’s still investigating the scope of the impact.
Timeline
| Date (2026) | What Capcom says happened |
|---|---|
| 19 October | Suspicious activity detected; access blocked and unauthorised access confirmed the same day |
| 20 October | Incident response headquarters set up; data access and password changes confirmed; external advisory committee informed |
| 21 October | Incident reported to Osaka Prefectural Police and Japan’s Personal Information Protection Commission |
| 22 October | Public notice published |
Capcom adds that it has identified and addressed the attack method. It hasn’t said when the intrusion began.
The phishing risk
Email addresses can’t be reset the way passwords can, so they’re the part of this breach that lingers. Capcom says registered addresses can keep being used, but warns the data could be misused to send fraudulent emails or messages impersonating Capcom or related parties. Its advice is to avoid opening links or attachments in any suspicious message.
The company says it will implement measures to prevent a recurrence and publish further facts on its official website if any emerge. It has also apologised to customers and other stakeholders. This isn’t Capcom’s first incident: VGC notes the company disclosed a ransomware attack in November 2020 that exposed hundreds of thousands of pieces of personal data, including names and addresses of customers and former employees.
What to do if you have a Capcom ID
Capcom hasn’t asked everyone to change their password, since it says user-set passwords weren’t confirmed as compromised. We still recommend a reset if you use CAPCOM ID, and a firm one if you’ve reused that password on another site. Check your account for changes you didn’t make, such as a new password or email address, and treat any email mentioning the breach, a “verification” or a prize as suspect. Go to Capcom’s site by typing the address, not by tapping a link in a message.
Capcom’s notice assigns Europe, the Middle East and Africa to Capcom Europe Customer Support, reachable through Capcom’s online inquiry form or at feedback@capcom.com. The notice gives only a worldwide total, so there’s no way to tell from it how many of the affected accounts are in the Gulf or Egypt.
Do I need to change my Capcom ID password?
Capcom hasn’t confirmed that passwords set by customers were compromised, and it has already reset the 196 that were changed. Resetting yours is a sensible precaution, though, especially if you use the same password elsewhere.
How will I know if my account was affected?
Capcom says it will notify affected customers. Until then, don’t act on any email about the breach that arrives with a link or attachment, because the leaked email addresses could be used to send convincing fakes.
Can I still play online?
Yes. Capcom says CAPCOM ID services, including games that use them, remain available, and that the incident doesn’t affect players’ ability to access or play its games.
