Capcom said on Oct. 22, 2026 that an unauthorized party got into CAPCOM ID, the account system behind its web services and some online games, and took customer information. In its notice, the company puts the count at 11,774,247 records. If you have a CAPCOM ID, here is what was taken and what to do.

What Capcom has said

According to the notice:

  • 11,774,247 records worldwide had their email address and account details exposed: account creation date and time, last login date and time, login count and the IP address used at last login.
  • 43 records also had date of birth, gender, country or region, and nickname exposed. These are part of the larger group.
  • 196 accounts had their passwords changed without authorization. Capcom has reset them. These are also part of the larger group.
  • Capcom says credit card information is not included, and it has not confirmed that passwords users set themselves were leaked.
  • It spotted suspicious activity on Oct. 19, blocked access and began investigating that day, and reported the incident to the police and to Japan's Personal Information Protection Commission on Oct. 21.
  • CAPCOM ID remains available, and gameplay in Capcom's games is not affected.
  • Affected customers will be contacted individually, in sequence. Capcom's notice lists a dedicated toll-free line for Japan (0120-801-271, 10:00-20:00) and customer support pages for the Americas and Europe.

What is not known yet

  • How many people. Capcom counts records, and its notice does not say whether each one is a different person. Do not read 11.7 million as 11.7 million people.
  • How the attackers got in. Capcom's notice says it has identified the attack method and completed its response, but does not describe the method.
  • Whether passwords were taken. Capcom says it has not confirmed that user-set passwords leaked. That is not the same as saying they were safe.
  • Who did it and why. The notice names no group and mentions no demand. It refers only to an unauthorized third party.

What to do

An email address and login history cannot be recalled, but the practical risk is phishing, and a few steps cut it.

  1. Expect fake Capcom emails. Capcom itself warns of messages impersonating it or related parties. Do not click links or open attachments in unexpected mail, even if it names your account. Open capcom.com yourself instead. Our checklists on scam protections in Google Messages and Chrome's suspicious-site warning can help.
  2. Check your password habits. CISA advises a different strong password for each account, because a leak at one service can expose another account that shares the password. If your CAPCOM ID password is reused elsewhere, change it on those sites. A passkey avoids the issue where offered: the FIDO Alliance says passkeys are designed with no shared secrets, so a breached server has no password to steal.
  3. Check whether you were locked out. If you cannot sign in, you may be among the accounts whose password was changed. Capcom says it has reset them; use its support channels for your region.
  4. Look up your email on Have I Been Pwned. It is a free tool that shows which known breaches include your address. Breaches are checked before they are published, so this one may not appear right away.
  5. Contact Capcom only through its own site. Use the support links in the notice, not links in an email or message.

We will update this story if Capcom says more.

Why it matters

The notice describes more than records being read: 196 accounts had passwords changed without authorization, so the attacker could act on accounts, not only copy data. And because the count is records rather than people, the number of affected individuals is still unknown.