Capcom confirmed on Oct. 22 that a third party broke into CAPCOM ID, the shared login system behind its online services, and took the email addresses and account details of more than 11.7 million customers. The exact count in the company’s notice is 11,774,247 accounts worldwide. Credit card information was not part of the leak.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The disclosure came three days after the publisher of Resident Evil, Monster Hunter and Street Fighter first spotted suspicious access. For anyone who ever registered a CAPCOM ID to play, buy or sign up for newsletters, the practical question is what was taken and what an attacker could do with it.
What the CAPCOM ID leak contained
According to Capcom’s own incident notice, every one of the 11,774,247 affected accounts lost an email address plus a set of system identifiers: the date and time the account was created, the date and time of the last login, the number of logins, and the IP address used at that last login. That is a thin profile compared with a typical gaming-platform breach, but it is exactly the kind of list that phishing crews like to buy.
A far smaller group lost more. For 43 of the accounts, the notice says a date of birth, gender, country or region, and nickname were also exposed. Capcom reported that it found no evidence that passwords users chose for themselves had leaked. BleepingComputer’s report on the breach, written by Bill Toulas, describes the same split: a very large list of addresses and a handful of richer profiles, with no card data in the mix.
196 accounts had their passwords changed
The one place where attackers touched credentials directly was a group of 196 accounts. Capcom says login passwords on those accounts were changed without authorization, which would have locked the real owners out. The company has reset them, and its notice stresses that the full scope of the impact is still under investigation, so the figure of 196 should be read as a count at the time of announcement rather than a final tally.
Why would an intruder rewrite passwords on fewer than 200 accounts out of nearly 12 million? The notice does not say, and Capcom has not described how the attackers got in beyond stating that it has identified the attack method and completed emergency measures. Outside researchers have no technical detail to test against, which leaves both the motive and the entry point open.
The October timeline and Capcom’s response
The notice lays out a tight sequence. On Oct. 19, Capcom detected signs of suspicious access, cut it off, began investigating and confirmed the unauthorized entry that same day. On Oct. 20 it set up an internal response headquarters, confirmed both the data leak and the unauthorized password changes, and informed its external security oversight committee. On Oct. 21 it reported the incident to the police and to Japan’s Personal Information Protection Commission, the national privacy regulator. The public announcement followed on Oct. 22.
Capcom says CAPCOM ID and all of its games remain available and that gameplay is not affected. Because of the volume, affected customers are being notified in sequence rather than all at once, and the company has opened separate support channels for Japan, the Americas, Europe, the Middle East and Africa, and Asia-Pacific.
The advice to customers is narrow and sensible. Capcom warned that the leaked details could be used in phishing emails that impersonate the company, and told recipients not to click links or open attachments in unexpected messages. Anyone who gets an email claiming to come from Capcom and asking for extra information should treat it with suspicion, because the attackers now hold a verified list of addresses tied to a gaming publisher. Because the stolen record includes the date and IP address of the last login, a message that quotes those details deserves extra scrutiny.
A second serious incident in six years
The company has been here before. In November 2020, a ransomware attack began with unauthorized access to its network. By its January 2021 update, Capcom had verified that the information of 16,415 people was compromised and estimated that up to about 390,000 customers, business partners and other outside parties could have been exposed, while noting that some logs had been lost and the full scope could not be precisely determined.
Coverage of Capcom’s final report on that attack said the intruders had gotten in through an older backup VPN used by North American staff, which Capcom then removed. The 2026 case differs in kind and scale. The earlier incident reached employees, partners and outside records, whereas the CAPCOM ID breach reaches the account base of a platform used across several regions, though with far less sensitive content per person.
What the two share is a company that again says the cause is known. Capcom has promised to publish new findings on its official website as the investigation continues, and account holders who reuse a CAPCOM ID password elsewhere should change it everywhere, even though Capcom says self-chosen passwords did not leak.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
