Capcom has confirmed a data breach affecting 11,774,247 Capcom ID accounts, after an unauthorized third party accessed account information. The company disclosed the incident in October 2026, warning users that exposed email addresses could increase the risk of phishing attempts.
The compromised information included email addresses and account activity details. Capcom ID is a free account service used to access online features in selected games, including Street Fighter 6.
The company says the incident did not expose users’ self-created passwords or credit card information. However, the attacker changed 196 account passwords without permission. Capcom has reset those passwords to prevent unauthorized account takeovers.
WHAT INFORMATION WAS EXPOSED IN THE CAPCOM ID BREACH?
The exposed information included email addresses, account creation dates and times, last login details, login counts, and IP addresses associated with users’ most recent logins. Capcom also reported that additional personal details were accessed for 43 accounts, including dates of birth, gender, country or region, and nicknames.
The company has stated that users whose accounts were accessed will be notified. Aside from the 196 accounts requiring password resets, other users should generally be able to continue using their Capcom IDs as usual.
Capcom detected suspicious activity on October 19 and began blocking unauthorized access while investigating the incident. The company established an internal response team the following day and reported the breach to Japanese police and the country’s Personal Information Protection Commission on October 21.
In a subsequent update published on October 23, Capcom disclosed that personal information had also been exposed through the account pages of 19 of the 196 accounts whose passwords were changed. The additional information included names, telephone numbers, postal codes, addresses, purchase histories, and inquiry histories. This expands the details of the incident beyond the initial October 22 disclosure.
The company has warned that exposed email addresses could be used for fraudulent messages impersonating Capcom. Players should avoid clicking suspicious links or opening unexpected attachments, particularly messages claiming to be about account security.
