Quick Answer
Capcom says unauthorized access to CAPCOM ID exposed 11,774,247 email-address records worldwide, along with account metadata. The company says attackers changed passwords on 196 accounts, while 19 Japanese e-Capcom store accounts had additional personal and purchase data accessed. Change your CAPCOM ID password, avoid unsolicited Capcom messages, and review account activity before using any store or account link.
Key Takeaways
- Capcom says 11,774,247 CAPCOM ID email-address records were exposed worldwide.
- Exposed account metadata included last-login information and the client IP address used at the last login.
- Attackers changed passwords for 196 CAPCOM ID accounts, and Capcom reset those passwords.
- Capcom says credit-card information was not among the affected data.
- Users should expect phishing attempts that imitate Capcom, game services, or customer support.
What happened in the Capcom data breach?
The Capcom data breach involved unauthorized access to the company’s CAPCOM ID unified account service, which exposed 11,774,247 email-address records worldwide. Capcom detected suspicious activity on October 19, 2026, blocked access, confirmed unauthorized access that day, and began emergency response measures.
Capcom disclosed the incident on October 22, 2026, after reporting it to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21. Capcom’s incident notice says CAPCOM ID services and games remained available during the response. This matters because an account service can remain online after a breach, but users still need to treat unexpected account messages and password prompts carefully.
The Capcom data breach does not mean every affected email account was taken over. The disclosed exposure creates a meaningful phishing risk because attackers can use real email addresses and account-related details to make fraudulent messages appear more credible. The practical response is to use a directly typed or bookmarked Capcom website rather than a link in an email, text message, or social-media direct message.
What CAPCOM ID data was exposed?
The exposed CAPCOM ID data included email-address records and account metadata, rather than credit-card information. Capcom says the metadata included account-creation time, last-login time, login count, and the client IP address used at the last login. These details can reveal account-use patterns that make a phishing message seem more personalized.
Capcom says 43 accounts had additional exposed information: date of birth, gender, country or region, and nickname. The smaller number does not remove the risk for those users, because date of birth and location details can help an attacker build a convincing impersonation attempt or combine information with data from another incident.
| Data category | Capcom says it was exposed | Why it matters |
|---|---|---|
| Email-address records | 11,774,247 records worldwide | Email addresses can be used for phishing messages that imitate Capcom. |
| Account metadata | Account-creation time, last-login time, login count, and last-login client IP address | Account-use details can make fraudulent account alerts appear more believable. |
| Additional profile data | Date of birth, gender, country or region, and nickname for 43 accounts | Personal details can increase impersonation and social-engineering risk. |
| Credit-card information | Capcom says it was not affected | Users should still watch for payment-themed scams, even though card data was not included. |
The exposed client IP address is a network identifier that can indicate the internet connection used during a login. A client IP address does not normally provide an attacker with direct control of an account, but it is still personal account metadata that should not be publicly exposed. Users who receive an unusually specific Capcom message should verify the request through an official account page before responding.
Were CAPCOM ID passwords or credit cards exposed?
Capcom says attackers changed passwords on 196 CAPCOM ID accounts, and the company reset those passwords after identifying the issue. Capcom also says it had not confirmed theft of customers’ original passwords. That distinction matters because a password change by an attacker can block the legitimate owner even when the attacker did not obtain a usable copy of the previous password.
Capcom says credit-card information was not among the affected data. Users do not need to assume that a payment card was exposed through this incident based on Capcom’s disclosure, but users should remain alert for fake refund, subscription, purchase-confirmation, or billing notices that use the breach as a pretext.
CAPCOM ID users should change their password if they have not already done so, especially if the same password appears on another service. Password reuse turns a breach involving one account into a broader account-security problem because an attacker can try the same email and password combination elsewhere. Readers concerned about breach-related fraud can also review how text scam detection works, although a detection feature does not replace careful verification of unexpected messages.
What additional data was accessed from e-Capcom store accounts?
The Capcom data breach affected 19 e-Capcom store accounts beyond the larger CAPCOM ID exposure, according to Capcom’s October 23 follow-up. Capcom says unauthorized access to store pages for those 19 accounts exposed names, phone numbers, postal codes, addresses, gender, birth dates, purchase histories, inquiry histories, and saved address books.
Capcom says the 19 affected e-Capcom accounts were in Japan. The limited number is important context, but the data categories are more sensitive than a standard email-address record because home-address and purchase-history information can support more targeted impersonation attempts. A message that refers to a real game order, delivery, or customer-service inquiry deserves extra scrutiny rather than immediate trust.
The safest response is to avoid confirming personal information through an incoming message. Open the relevant account or retailer website independently, then look for notifications and account activity there. Do not provide a one-time code, password, address, or payment information to a caller or sender who contacted you first, even if the message uses Capcom branding or appears to reference a real purchase.
How can CAPCOM ID users protect their accounts now?
CAPCOM ID users should change their password, check for unfamiliar account activity, and treat unsolicited Capcom communications as potentially fraudulent. Capcom specifically warned users to watch for phishing emails, SMS messages, and calls that impersonate Capcom or related parties. Independent coverage of the breach also notes the scale of the exposed account records.
- Change the CAPCOM ID password from a trusted browser session or an official account page you opened yourself.
- Use a unique password that is not used for email, gaming platforms, shopping sites, or financial accounts.
- Review recent account activity and look for unfamiliar password changes, profile edits, or purchase-related messages.
- Ignore unexpected links, attachments, verification codes, and refund offers that claim to come from Capcom.
- Secure the email account connected to CAPCOM ID, because email access can enable password-reset abuse.
CAPCOM ID users should stop and contact Capcom through an official support path if an account cannot be accessed after a password reset, shows unfamiliar personal details, or contains activity the user cannot explain. Do not attempt to resolve an account dispute through a phone number or link supplied in an unsolicited message. The official support route is safer because a phishing campaign can copy the appearance of a genuine security notice.
Why does the Capcom data breach create a phishing risk?
The Capcom data breach creates a phishing risk because exposed email addresses and account metadata can help attackers send messages that appear connected to a real CAPCOM ID account. A fraudulent email can claim that a login was detected, a password needs to be reset, or a store order requires confirmation. The attacker’s goal is usually to obtain a password, a one-time verification code, payment details, or access to an email account.
Capcom has already warned about phishing emails, SMS messages, and calls impersonating the company or related parties. The most important point is that a convincing message is not proof of authenticity. A real name, nickname, country, or partial account information can make a message more persuasive, but users should verify the request through a website or app opened independently.
Gaming accounts are frequent phishing targets because users may link them to storefronts, community services, email accounts, and payment methods. The same caution applies to other account incidents, including reports involving Discord account data, where exposed information can be used to make follow-up scams look legitimate. The practical response is to trust the destination you open yourself, not the link or number delivered by an unexpected message.
What should users monitor after the Capcom data breach?
CAPCOM ID users should monitor account access, password-reset notices, unfamiliar login alerts, and messages that reference Capcom purchases or support requests. Capcom says the affected metadata included the last-login time and client IP address, which means an attacker may have details that make a false login warning sound plausible.
Email security deserves the same attention as CAPCOM ID security because email accounts often receive password-reset links. Review the email inbox for unexpected reset requests, security alerts, and forwarding rules that were not created by the account owner. Change the email password if there is any sign of unauthorized access, and use the email provider’s official security settings rather than a link in an alert message.
Users should also watch for messages that create urgency, such as claims that an account will be banned, an order will be canceled, or a refund expires immediately. Urgency is useful to scammers because it encourages a quick response before the recipient checks the sender or destination. The most sensible approach is to pause, open the official service independently, and contact verified support if the account page confirms a problem.
What does Capcom say about its response?
Capcom says it blocked the suspicious access after detecting it on October 19, confirmed unauthorized access the same day, and took emergency response measures. The company then reported the incident to Japanese authorities on October 21 and disclosed the affected CAPCOM ID information on October 22.
Capcom says CAPCOM ID services and games remained available, and it reset passwords for the 196 accounts where attackers changed passwords. Security coverage of the incident describes the breach as affecting more than 11 million records, which places the disclosure among the larger consumer gaming account exposures.
Capcom’s response does not eliminate the need for individual account protection. A company can block the original unauthorized access while criminals still use exposed email addresses and account details in later phishing campaigns. CAPCOM ID users should change reused passwords, verify communications independently, and seek official support for access problems rather than responding to an unsolicited contact.
FAQ
Did the Capcom data breach expose credit-card information?
Capcom says credit-card information was not among the affected data. Users should still ignore unexpected billing or refund messages because scammers can use breach news to create fake payment alerts.
How many accounts were affected by the Capcom data breach?
Capcom says 11,774,247 email-address records were exposed worldwide through CAPCOM ID. The company also says 196 accounts had passwords changed by attackers, and 19 Japanese e-Capcom store accounts had additional data accessed.
Should CAPCOM ID users change their passwords?
CAPCOM ID users should change their passwords, particularly if the same password is used on another service. A unique password reduces the risk that one compromised account credential can be used to access other accounts.
What information was exposed from CAPCOM ID accounts?
Capcom says exposed information included email addresses, account-creation time, last-login time, login count, and the client IP address used at the last login. Capcom says 43 accounts also had date of birth, gender, country or region, and nickname exposed.
How can users identify a fake Capcom security message?
A fake Capcom security message often asks for a password, verification code, payment detail, or urgent action through a supplied link or phone number. CAPCOM ID users should open the official site independently and verify any account issue there before responding.