Japanese video game publisher Capcom has reported a data breach involving 11,774,247 records containing email addresses and account-related information worldwide. The company, known for franchises such as Resident Evil, Street Fighter and Monster Hunter, confirmed unauthorised access to its CAPCOM ID membership service.
The incident has raised concerns about possible phishing attempts against gamers whose email addresses may have been exposed. Capcom disclosed the breach on October 22, 2026, after detecting suspicious activity three days earlier.
The company’s investigation also found that passwords had been changed without authorisation on 196 accounts. Capcom says it has introduced emergency security measures and started contacting affected customers. According to the company, no credit card information was exposed.
What Happened in the Capcom Data Breach?
The security incident involved CAPCOM ID, an account system that gives users access to various Capcom games and online services.
Capcom detected unusual activity on October 19 and took steps to block the unauthorised access. By October 20, the investigation had established that customer information had been compromised.
The company subsequently informed Japanese police and relevant privacy authorities. Investigations into the incident and its full impact are continuing. Capcom has not publicly identified the attackers or explained precisely how they gained access to its systems.
What Information Was Exposed?
The compromised records mainly contained email addresses and technical information associated with CAPCOM ID accounts. The company also identified a smaller group of records containing additional personal details.
| Information affected | Reported figures |
|---|---|
| Email addresses and account-related records | 11,774,247 |
| Records containing additional personal details | 43 |
| Accounts with passwords changed without permission | 196 |
| Credit card information | No exposure reported |
The account-related information reportedly included registration dates, previous login times, login counts and IP addresses associated with earlier sign-ins.
For 43 records, the exposed information also included details such as dates of birth, gender, country or region and account nicknames.
Capcom said investigators had found no evidence that users’ original passwords were leaked. The company has reset the passwords of the 196 accounts affected by unauthorised changes.
Are Resident Evil and Street Fighter Players Affected?
People who use CAPCOM ID could potentially be affected by the incident. The account system supports services connected to games including Street Fighter 6 and Resident Evil.
Capcom has stated that its games remain playable and that CAPCOM ID services continue to operate. However, users should remain alert to suspicious messages and unusual account activity while the investigation continues.
The exposure of email addresses and account information could give scammers material to create convincing messages that appear to come from Capcom or its associated services.
What Should Capcom Users Do Now?
Users should take precautions to protect their accounts and avoid falling victim to phishing scams. Emails requesting passwords, verification codes or other sensitive information should be treated carefully, particularly if they contain unexpected links.
Players should review their account activity, change passwords that have been reused across multiple services and enable two-factor authentication wherever it is available.
Capcom has begun notifying affected customers individually and has established a dedicated inquiry service for questions about the incident. Users who receive an official notification should follow the security instructions provided and avoid sharing confidential account details with unverified sources.
Disclaimer
This article is intended for general informational purposes only. The breach details and figures are based on the information provided and have not been independently verified. The investigation may reveal further information, and the scope of the incident could change as additional findings emerge. Users should refer to Capcom’s official announcements for confirmed updates and follow its recommended account-security measures.