Capcom Says 11.7 Million CAPCOM ID Records Were Exposed, and 19 Hijacked Accounts Reached Its Japanese Shop Data

Since Capcom detected suspicious activity on its CAPCOM ID membership service on Monday, Oct. 19, the Japanese publisher has gone from a routine-sounding intrusion notice to a breach touching 11,774,247 records and, as of Friday's update, a smaller set of accounts that were actively taken over.

What was taken

Capcom's Oct. 22 notice says a third party gained unauthorized access to CAPCOM ID, the shared login used for its web services and online play in games such as Street Fighter 6.

For all 11,774,247 records, the exposed data includes the email address, account creation date and time, last login date and time, number of logins, and the IP address used for the most recent login.

For 43 of those records, Capcom says the attacker also got date of birth, gender, nickname, and country or region.

Capcom says credit card information was not part of the affected data. It also says it has not confirmed that passwords customers originally chose were exposed.

The 11.7 million figure counts records, not people. Someone with more than one CAPCOM ID would be counted more than once, so the number of affected individuals could be lower.

The 196 hijacked accounts

The attacker also changed the passwords on 196 accounts, apparently to lock the owners out. Capcom says it reset those accounts and restored them to their rightful owners.

The Oct. 23 update added a detail the first notice did not contain. Capcom said attackers used 19 of those 196 accounts to open customer pages on e-Capcom, its online shopping site, and view additional personal information. All 19 accounts were registered in Japan.

Capcom has not said publicly how the attacker was able to change those passwords. It also has not said whether the 196 accounts were chosen at random or for a reason.

The company says its investigation into the impact on those accounts, including whether any other unauthorized activity occurred, is continuing.

Timeline of the response

Capcom says it detected suspicious activity on Oct. 19 and blocked access. By Oct. 20 it had determined that customer information had been compromised. It set up an internal incident response headquarters and informed the Information Technology Security Oversight Committee, an external body that advises the company.

On Oct. 21 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. It published the notice the next day, Oct. 22.

The company says it has "identified and addressed the attack method" and finished its emergency response. It has not described what that method was. No group has claimed responsibility.

In its Oct. 23 update, Capcom said it had completed its assessment of the incident's impact. It will keep monitoring CAPCOM ID and related services and put preventive measures in place.

What users are being told

CAPCOM ID still works, and Capcom says games and online services are unaffected. The company's main warning is about phishing. A list of real email addresses tied to a Capcom account is useful to anyone who wants to send convincing fake Capcom messages.

Capcom asks users not to open URLs or attachments in suspicious emails or messages. Security firm Malwarebytes advises going to the account site directly in a browser instead of clicking through a message that claims an account needs attention.

Capcom says it will notify affected customers in stages. It has opened region-specific support channels: a toll-free line in Japan and online inquiry forms for the Americas and for Europe, the Middle East and Africa.

A repeat problem

This is not Capcom's first major breach. In November 2020, the Ragnar Locker ransomware gang attacked the company and claimed to have stolen 1 TB of data. Capcom said that incident could affect up to 390,000 people, according to BleepingComputer; other outlets put the figure at up to 350,000 customers, business partners and employees. The company later traced that intrusion to an old VPN device. Europol has since dismantled Ragnar Locker.

The 2026 case differs in kind. The data at issue is mainly contact and account-activity information on a far larger user base, and the company's own notice makes no mention of ransomware or any extortion demand.

What remains open

Capcom says original customer passwords were not confirmed as exposed, yet someone was able to change 196 of them. The company has not explained how that was done. Capcom has said it will publish further updates on its website if its investigation turns up anything else that needs to be disclosed.