Capcom has confirmed a data breach involving more than 11.7 million records linked to its CAPCOM ID account service. The exposed information includes email addresses and account-related data, while a much smaller number of records contained additional personal details.
If you use CAPCOM ID, there's reason to pay attention. Capcom says credit card information was not affected, but exposed email addresses could still be used in phishing attempts targeting players.
What information was exposed in the Capcom hack?
According to Capcom's official announcement, the incident affected 11,774,247 records. The information involved includes:
- Email addresses
- Account creation times
- Last login times
- Login counts
- The IP address used during the most recent login
Capcom also confirmed that 43 records contained additional personal information, including dates of birth, gender, country or region, and account nicknames.
In addition, the login passwords for 196 accounts were changed without authorisation. Capcom says it has not confirmed that the original passwords were exposed, and the passwords for those affected accounts have been reset.
It's worth keeping the numbers in perspective. The figure of 11.7 million refers to affected records, not to 11.7 million accounts with every type of personal information exposed.
Could your email address be affected?
At this point, there is no confirmation that the Capcom incident has been added to Have I Been Pwned, a service that lets users check whether their email addresses appear in known data breaches.
You can use the service to check for other known breaches involving your email address, but the absence of a Capcom-related result does not prove that your information was unaffected. A newly disclosed incident may not yet be listed, and Capcom has not published a complete list of affected email addresses.
If you have a CAPCOM ID account, keep an eye on your inbox and be cautious with unexpected messages claiming to be from Capcom.
Capcom warns about possible phishing emails
Capcom detected suspicious activity on October 19, 2026, and confirmed unauthorised access to its systems that same day. The company publicly disclosed the incident on October 22, after taking emergency measures and reporting the breach to the relevant authorities in Japan.
According to Capcom, the attack method has been identified and addressed, and services using CAPCOM ID remain available. The company also says it will contact affected customers.
Even so, exposed email addresses could make it easier for scammers to send convincing messages pretending to come from Capcom or related organisations. These emails might attempt to trick players into visiting fake login pages or sharing account details.
If you receive an unexpected message about your CAPCOM ID, don't rush to click its links or open attachments. Visit Capcom's official website directly if you need to check your account or contact support.
What should CAPCOM ID users do now?
Capcom has not announced that all users need to stop using CAPCOM ID. Its services remain available, but taking a few precautions is sensible:
- Be careful with unexpected emails claiming to come from Capcom.
- Don't click suspicious links or open unexpected attachments.
- Never provide your password in response to an unsolicited email.
- Check Have I Been Pwned for other known breaches involving your email address, while remembering that the Capcom incident may not be listed.
- If you have concerns about your account, contact Capcom through its official support page.
Capcom says credit card information was not involved in the incident. The company is continuing its investigation and says it will provide further information if necessary.
Webmastahhh is the creator of Mastanet, a gaming and technology website where he shares news, reviews, guides and personal insights about games, hardware, software and the future of digital entertainment.
