Capcom has confirmed that an outsider got into its CAPCOM ID account platform and accessed more than 11.7 million email address records, and took over 196 accounts by changing their passwords. Card data was not affected, but the stolen records are well suited to targeted phishing of UK gamers, and of the companies whose staff signed up with a work address.
What happened
On 22 October 2026 the Osaka-based publisher behind Resident Evil, Monster Hunter and Street Fighter published a formal notice and apology about unauthorised access to CAPCOM ID. CAPCOM ID is a single membership account that works across the company’s web services, and players need one to use the online features of some games.
The company’s timeline is short. On Monday 19 October it saw suspicious activity on the platform, started blocking it, and confirmed that day that a third party had got in. On 20 October it set up an internal incident response headquarters, found that customer records had been accessed and that some accounts had had their passwords changed, and briefed its external security advisory committee. On 21 October it notified Osaka Prefectural Police and Japan’s data protection regulator, the Personal Information Protection Commission. The public notice followed the next day.
Capcom says it has finished its emergency response and has “identified and addressed” the method the intruder used, and services remain available. The company will contact affected customers directly and has set up support channels in each region, including a Capcom Europe contact route for players in Europe, the Middle East and Africa.
The detail
The figures, as of 22 October, are:
- 11,774,247 records containing an email address and what Capcom calls system-specific identifiers: when the account was created, when it last logged in, how many times it has logged in, and the client IP address used for the most recent login.
- 43 of those records also contained date of birth, gender, country or region, and nickname.
- 196 accounts had their login password changed without the owner’s consent. Capcom has reset those passwords.
Capcom says it has found no sign that passwords chosen by customers were compromised, and that no credit card information was involved. It describes 11.7 million as a worldwide total and has not said how many records belong to each country. As Inven Global notes, that makes it impossible to gauge the impact on any single market. The notice also does not say when the intrusion started, how long the attacker had access, or how they got in.
That last point matters, because the shape of the data tells us something. Millions of records were taken, but only a few hundred accounts were actually hijacked. That points to an attacker who could read account data in bulk but used write access, or the ability to reset a password, sparingly. The root cause is not public and it would be speculation to name one; Capcom says its investigation continues.
Why it matters for UK organisations
Capcom has a large player base in Britain, so it is reasonable to assume a significant number of UK residents are among those affected, even though the company has given no regional figures. UK GDPR applies to controllers based outside the UK when they offer services to people here, so the duties to tell individuals and the ICO about a breach likely to put people at risk can apply to a Japanese publisher. Capcom has not said what notification, if any, it has made in the UK.
For businesses, the gaming angle can look like someone else’s problem. Gaming accounts are often created with whatever email address is to hand, and that is regularly a work address. A record tying a corporate email to a last-login IP address and a precise login history helps an attacker. It confirms the mailbox is live, may reveal a home or office network range, and gives a believable story for a phishing message (“we detected a new login to your CAPCOM ID from…”).
Capcom itself warns that the data could be used to send fraudulent messages pretending to come from the company. We should take that warning seriously. A fresh, verified list of more than 11 million addresses, each with a reason to expect a security email from a well-known brand, is exactly what phishing kit operators want.
Expert view
When we test consumer-facing platforms, account recovery and profile management are routinely the weakest parts. They are built for convenience, often older than the main login flow, and less closely monitored. A pattern of bulk reads plus a small number of password changes is consistent with that class of weakness, although Capcom has not said what the root cause was and nobody should assume it.
Credit where it is due: going from detection to a public, numbered disclosure in about three days is faster than many organisations manage. Exact counts, a dated timeline and named regulators set a reasonable standard. What is missing is the attack vector and the period of exposure, and those are the two facts defenders elsewhere most need to judge whether they have the same weakness.
The 43 records with date of birth and gender are a small number, but they are worth noting. They suggest that the store the attacker reached holds richer profile data for some users, which raises the question of whether the attacker’s access was really limited to email and login metadata. I would treat the current numbers as a floor rather than a ceiling until the investigation is finished.
What to do now
- Warn staff about Capcom-themed phishing. Brief staff and the service desk that genuine Capcom notices will not ask for passwords or card details, and tune mail filters for Capcom-branded lures. This supports the Cyber Essentials malware protection and secure configuration controls by cutting the chance that a lure succeeds.
- Check where corporate addresses are used. Remind staff that work email should not be used for personal gaming or entertainment accounts, and use breach-notification services to monitor your domains for exposure.
- Enforce MFA and stop password reuse. Capcom says it found no sign that customer-set passwords were taken, but any reuse between personal and work accounts is a standing risk. Enforcing multi-factor authentication on email, VPN and cloud services is central to the Cyber Essentials user access control requirements.
- Players should secure their accounts. Change the CAPCOM ID password, use a unique one, review linked platforms and recent activity, and contact Capcom support through the official site if anything looks wrong.
- Review your own account recovery. If you run a customer platform, test password reset and profile-change flows for rate limiting, alerting and abuse at scale. This is where incidents like this one tend to start.
Bottom line
Capcom’s breach is wide but shallow: more than 11.7 million email records and login metadata, 196 taken-over accounts, and no payment data. Its quick, specific disclosure is welcome, but the attack vector and the length of exposure are still unknown. For UK organisations the immediate risk is not the leak itself but the wave of convincing Capcom-branded phishing that is likely to follow, so prepare staff and filters now.
Sources
- Capcom: Notice and Apology Regarding Customer Information Affected Through Unauthorized Access
- Inven Global: Capcom Cyberattack Exposes 11.77 Million CAPCOM ID Records, Including Emails
- Notebookcheck: Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide
- Windows Central: Capcom suffers massive data breach exposing private information from over 11.7 million Capcom ID accounts worldwide
