Full Breakdown
Capcom Data Breach Exposes Over 11 Million User Records
By Drooid · · How we work
Core Event: Unauthorized Access to CAPCOM ID
Capcom disclosed that a third-party gained unauthorized access to its online membership platform, CAPCOM ID, on October 19, 2026. The breach exposed the email addresses and system-specific identifiers of 11,774,247 accounts worldwide. In a smaller subset, 43 records also contained date of birth, gender, country/region, and nickname. Additionally, 196 accounts experienced illicit password changes, though the company has not confirmed that the original user-set passwords were leaked. Credit-card information was not part of the compromised data, and gameplay for Capcom titles remained unaffected.
Background & Context
CAPCOM ID is a unified account used across Capcom’s online services and multiplayer-enabled games such as *Resident Evil*, *Monster Hunter*, *Street Fighter 6*, and *Exoprimal*. The platform stores basic account metadata to enable cross-title features and user authentication.
Timeline
- October 19, 2026 – Capcom detected suspicious activity and confirmed unauthorized access.
- October 20, 2026 – An internal response team was established and the leak of customer information and unauthorized password changes was identified.
- October 21, 2026 – The incident was reported to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
- October 22, 2026 – Capcom publicly announced the breach, detailed the scope of the leak, and confirmed that emergency security measures had been completed.
Data & Statistics
- Email addresses and system identifiers: 11,774,247 records (global total).
- Additional personal details: 43 records (date of birth, gender, country/region, nickname).
- Illicit password changes: 196 accounts (passwords have been reset).
- Credit-card data: No records compromised.
Official Statements & Responses
Capcom emphasized that “no leaks of passwords set by the customers themselves have been confirmed” “No leaks of passwords set by the customers themselves have been confirmed” — though the company. The company asserted that user-chosen passwords remain secure and that all affected passwords have been reset. It reported that the breach was promptly blocked, emergency response actions were completed, and the attack method was identified and addressed. Capcom pledged to implement further security measures, strengthen its information-security framework, and provide updates through its official website and support channels. The firm also warned users to be vigilant for phishing attempts that might impersonate Capcom or its partners, advising against clicking links or opening attachments in suspicious messages.
Conflicting Reports & Gaps
- Password-change count: Most sources cite 196 accounts with unauthorized password changes, while one outlet reported 193 such accounts.
- Total records disclosed: Figures range from “over 11.7 million” to the precise 11,774,247 records. The variance reflects differing levels of precision in reporting rather than a substantive disagreement about the breach’s magnitude.
Verbatim Quotes
- “No leaks of passwords set by the customers themselves have been confirmed” — PC Gamer (quoted in Capcom’s announcement).
What’s Next
Capcom will continue its investigation into the breach’s cause and scope, maintain dedicated support hotlines for affected users, and issue further notifications as additional facts emerge. Users are advised to monitor their email for official communications, avoid reusing CAPCOM ID passwords on other services, and consider employing unique passwords or a password manager to mitigate future risks.