Capcom confirms hackers breached CAPCOM ID, exposing 11,774,247 accounts

Capcom said on Oct. 22, 2026, that hackers breached its CAPCOM ID membership service and exposed 11,774,247 accounts worldwide.

Capcom detected suspicious activity on Oct. 19, 2026, and confirmed unauthorized access the same day. By Oct. 20, 2026, the company’s investigation determined that the breach compromised customer information, and it confirmed data leaks and unauthorized password changes. Capcom established an internal task force on Oct. 20, 2026, to contain the incident and reported the breach to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on Oct. 21, 2026.

For all 11,774,247 affected accounts, exposed data includes e-mail addresses, account creation dates, last login timestamps, total login counts, and last login IP addresses. A smaller group of 43 accounts also had dates of birth, gender, country or region, and nicknames exposed. Capcom confirmed that user-created passwords and credit card information were not exposed in the breach.

Hackers changed login passwords for 196 of the affected accounts, but Capcom reset them all and said it found no evidence of leaked user-set passwords. The changes suggest the intruder could modify account records, not just read them, according to Tbreak Media UAE. Capcom states that its online services, including games using CAPCOM ID, remain unaffected and operational. Customers can continue using registered e-mail addresses, Tbreak Media UAE says.

CAPCOM ID is Capcom’s unified account system for accessing its web services and playing online games, including Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The service provides access to titles including Street Fighter 6, Pragmata, Resident Evil Requiem, and Onimusha: Way of the Sword. Gaming accounts like CAPCOM ID are high-value targets because they often control access to many services and may link to payment methods or other personal accounts, Tbreak Media UAE reports.

Attackers could potentially use exposed e-mail addresses for phishing attempts pretending to come from Capcom or related companies, according to reporting by Notebookcheck. e-mail addresses cannot be reset like passwords, so exposed addresses remain a lasting risk. Capcom has not said when the intrusion into CAPCOM ID began, and it identified the intrusion method without sharing details about the initial access.

Capcom is a Japanese video game developer and publisher with 4,000 employees and $1.24 billion in annual revenue. The company is known for major franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man. Capcom posted the breach notice on its investor relations site.

In April 2021, Capcom disclosed that attackers gained access through an old VPN device. The 2020 breach affected a smaller subset of data.

Capcom completed emergency response measures and identified and addressed the attack method involved in the incident. Capcom said, “Capcom has completed emergency response measures and has identified and addressed the attack method involved in this incident.” The company will take measures to prevent recurrence and further strengthen its information security framework, and it still investigates the full scope of the breach’s impact.

Capcom plans to notify affected customers in stages due to the large volume of accounts affected, and directly affected users can expect an e-mail in the coming days. The company established region-specific communication channels for affected customers to submit support requests. Capcom says it will publish further facts on its official website if any emerge.

The notice gives only a worldwide total, so the number of affected accounts in the Gulf or Egypt cannot be determined. For players in the UAE, Saudi Arabia and Egypt, the practical risk is phishing rather than lost money, Tbreak Media UAE reports. Capcom Europe Customer Support handles inquiries for Europe, the Middle East and Africa via an online inquiry form or feedback@capcom.com.

Capcom has not asked all customers to change their passwords, Tbreak Media UAE says. Customers should check their accounts for changes they did not make, such as a new password or email address. They should treat any email mentioning the breach, a verification, or a prize as suspect, avoid clicking links or opening attachments in unsolicited e-mails, and go to Capcom’s site by typing the address rather than tapping links in messages.