What Capcom confirmed
Capcom disclosed unauthorized access to CAPCOM ID, the shared membership account used for company web services and required by some online games. Its investigation counted 11,774,247 affected records worldwide. The exposed data included registered email addresses, account-creation and last-login timestamps, login counts, and the client IP address used for the last login. A smaller group of 43 records also included date of birth, gender, country or region, and nickname.
The company said credit-card information was not among the affected data and that it had not confirmed compromise of the original passwords customers set. CAPCOM ID services and games remained available after emergency measures. Those facts reduce some risks, but they do not make the exposed information harmless: an email address combined with account activity and IP-derived location clues can make fraudulent messages look credible.
A breach inside the breach
Capcom also found that passwords had been changed without authorization on 196 accounts. It reset those passwords and continued investigating the resulting impact. That subset should be treated separately from the 11.7 million-record disclosure. Access to profile data is one security event; changing a login credential is an action against account control.
The public notice does not explain how the 196 changes were performed, whether any affected accounts were used after the change, or whether the same technique could have reached more accounts. It would be premature to say attackers obtained the password database or that 11.7 million accounts were taken over. The confirmed statement is narrower: a large body of account information was accessed, and a small documented subset experienced unauthorized password changes.
Three days from detection to disclosure
Capcom detected suspicious activity and confirmed unauthorized access on October 19, 2026. It says it began blocking the access that day while investigating the cause and scope. On October 20, the company established an internal incident-response headquarters, confirmed customer information had been accessed, and identified the unauthorized password changes. On October 21, it reported the incident to Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
The October 22 notice says Capcom identified and addressed the attack method, completed emergency measures, and planned to notify affected customers. It did not publish the initial access method, the duration of access before detection, or technical evidence showing that containment was complete. BleepingComputer likewise noted that no initial-access details had been released.
The lesson is not just change your password
Capcom warned that the exposed information could be used in fraudulent messages impersonating the company or related parties. That is the immediate practical risk for most affected users. A message that names CAPCOM ID, arrives at the registered address, and refers to plausible login activity may pass the recipient’s first credibility check even if no password was stolen.
Users should avoid links or attachments in unexpected Capcom-themed messages and instead navigate independently to the official service. For the 196 reset accounts, recovery should include checking account activity and connected services, not merely selecting another password.
For service operators, the incident argues for treating metadata as security-sensitive and monitoring changes to recovery details and passwords as high-risk events. A password change made through a legitimate interface can still be hostile. Controls should include step-up verification for credential changes, independent notifications through an existing trusted channel, and rapid rollback or lockout when unusual changes cluster across accounts. Public updates should distinguish records viewed, accounts modified, and accounts demonstrably used; those are different harms requiring different responses.
What remains uncertain
Capcom has not disclosed the initial access technique, how long unauthorized access existed before October 19, how the 196 password changes were accomplished, whether those accounts were subsequently used, or whether accessed data has been misused. No attacker identity or motive is established.
Sources & method
AI-assisted research and drafting, reviewed by the editor before publication. Reporting is attributed to the sources below; this is not an independent forensic investigation.
- Capcom notice regarding customer information affected through unauthorized access · Original source · 2026-10-22
- Capcom confirms data breach affecting 11.7 million accounts · Reporting · 2026-10-22