Capcom data breach: 11.7 million CAPCOM ID records accessed, phishing risk
By Karan BansalTech Startups Correspondent, Peepals Tech
Representative image: 27707 / Pixabay
Capcom said on October 22, 2026 that 11.77 million CAPCOM ID records, mostly emails and login data, were accessed; passwords and card data not confirmed exposed.
What Happened
Japanese video game company Capcom said on October 22, 2026 that an unauthorised third party had accessed customer information linked to CAPCOM ID, the account system used for its websites and some online games. According to the company's notice, 11,774,247 records worldwide were affected, mostly email addresses with basic account details. Capcom said customer-set passwords had not been confirmed as leaked and that credit card information was not affected, but the attacker changed the passwords of 196 accounts, which the company has since reset.
Key Facts
- Records affected: 11,774,247 CAPCOM ID records worldwide, according to Capcom.
- Data in each record: an email address, account creation date, last login time, number of logins and the IP address (the internet address of the device) used at the last sign-in.
- 43 records also included date of birth, gender, country or region and nickname.
- 196 accounts had their passwords changed without authorisation; Capcom says it has reset them.
- A follow-up notice on October 23 said the intruder opened the e-Capcom online store pages of 19 affected accounts, exposing the names, phone numbers, addresses and purchase history of those Japanese customers.
- Timeline: the activity was detected on October 19; Capcom reported it to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21.
- Capcom has not said how the attacker got in, only that the method has been identified and dealt with.
Why It Matters
A data breach is an incident in which someone gets into a computer system without permission and sees or copies information stored there. In this case most of the exposed data is not secret on its own: an email address and login history. But at more than 11.7 million records, it is a large set of confirmed gamer email addresses tied to a well-known brand.
The main risk now is phishing: fake emails or messages that pretend to come from a trusted company to trick people into giving away passwords or payment details. Capcom itself warned that the stolen information could be used to send fraudulent messages posing as Capcom or related parties. A criminal who knows that an email address belongs to a Capcom player, and when that person last logged in, can write a far more convincing fake message.
The 196 accounts whose passwords were changed show that the attacker did more than read data. Changing a password locks the real owner out. Capcom has not explained how this was done, and says passwords chosen by customers were not confirmed as exposed.
For India, where gaming is a fast-growing pastime among young people, the breach is a reminder that game accounts hold real personal data. Many players use the same email and password across games, stores and social media, so one breach can lead to others. The case also shows how a company is expected to respond: notify users, report to police and the data protection regulator within days, and give a clear list of what was and was not exposed. India's Digital Personal Data Protection Act sets similar duties for companies that handle Indians' data.
What users should do: be suspicious of any email or message about a Capcom account, especially one asking you to click a link or log in; go to the official site directly instead. If you used your CAPCOM ID password anywhere else, change it there. Turn on two-step login wherever a service offers it.
| Data type | Affected |
|---|---|
| Email address and login history | 11,774,247 records |
| Date of birth, gender, region, nickname | 43 records |
| Passwords changed by the attacker | 196 accounts |
| Store details (name, phone, address, purchases) | 19 Japanese accounts |
| Credit card information | Not affected, according to Capcom |
Impact
Short-term: CAPCOM ID users worldwide face a higher risk of phishing messages using their real account details. Capcom is notifying affected users and has reset the 196 hijacked accounts.
Long-term: Japan's data protection regulator may examine the incident, and the case adds to pressure on game companies to strengthen account security, such as two-step login, as player accounts become richer targets.
Who is affected: people with a CAPCOM ID account, including players in India; the 19 Japanese store customers whose contact details were exposed; and other game companies watching how Capcom handles the case.
Key Takeaway
Capcom says 11.77 million CAPCOM ID records, mainly email addresses and login details, were accessed without permission, with passwords and card data not confirmed as exposed, so the main danger for users is phishing.
Questions and Answers
What happened in the Capcom data breach?
Capcom said on October 22, 2026 that an outsider accessed 11,774,247 CAPCOM ID records, mostly email addresses with account dates, login counts and last-login IP addresses. The activity was detected on October 19.
Were Capcom passwords or credit cards leaked?
Capcom says customer-set passwords have not been confirmed as compromised and credit card information was not affected. However, the attacker changed the passwords of 196 accounts, which Capcom has reset.
What should CAPCOM ID users do?
Treat any message about your Capcom account with caution and log in only through the official site. If you reused your CAPCOM ID password elsewhere, change it there, and turn on two-step login where possible.
Has Capcom reported the breach to authorities?
Yes. Capcom said it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission on October 21, 2026.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
By Karan Bansal, Tech Startups CorrespondentCovers Tech Start-ups & Stories and more for Peepals Tech. All stories by Karan Bansal
vivo Y600 with 10,000mAh battery launches in China on October 30
Moonshot AI releases Kimi K3.1 Pro, a 2.8-trillion-parameter open-weight model
Karan Bansal is a pen name of the Peepals Global Editorial Team, which researches, fact-checks and publishes every story. The portrait is an illustration.
