Capcom says a third party gained unauthorized access to CAPCOM ID, its online account service, and viewed email addresses and login records tied to 11,774,247 records worldwide. The company also says credit card information was not affected. In a notice and apology published on October 22, 2026, Capcom said the attacker changed the passwords of 196 accounts without permission. Those accounts have already been reset. Capcom also said it has not confirmed that any password set by users themselves was compromised.
CAPCOM ID is the free account that Capcom says “is needed to play certain Capcom games online”, and it also signs you in to sites like Buckler’s Boot Camp (Street Fighter 6) and the Resident Evil Portal. Capcom says the incident “does not affect players’ ability to access or play any of our games.”
Street Fighter 6's online services and Buckler's Boot Camp use CAPCOM ID. Image: Capcom
Table of Contents
What data was exposed in the Capcom ID breach
Capcom’s figures, “as of October 22” (the English notice is Capcom’s own translation; the Japanese original prevails if they differ):
| Affected data | Records |
|---|---|
| Email address, plus account creation date/time, last login date/time, number of logins and the IP address used for the last login | 11,774,247 (worldwide total) |
| Date of birth, gender, country/region and nickname | 43 (part of the total above) |
| Login password changed without authorization | 196 accounts (part of the total above, already reset) |
| Credit card information | Not affected |
Capcom counts “records”, not people, and doesn’t say how many separate users they cover.
When it happened and when Capcom found it
- October 19, 2026: Capcom detected suspicious activity on CAPCOM ID and began blocking the access. The same day, it confirmed that unauthorized access had taken place and put emergency measures in place.
- October 20: Capcom set up an internal incident response headquarters. It confirmed that customer information had been accessed and that some passwords had been changed. It also reported the matter to its external advisory body, the Information Technology Security Oversight Committee.
- October 21: Capcom reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission.
The notice does not say when the unauthorized access began, how the attacker got in, or who was behind it. Capcom says it has “identified and addressed the attack method” and is still investigating the full scope.
What Capcom is doing
Capcom says it will contact affected customers, has set up dedicated support channels, and will publish further facts “through the company’s official website and other appropriate channels.” It also plans measures to prevent a recurrence. The notice was also posted on the CAPCOM ID portal.
Exoprimal is among the games featured on the CAPCOM ID portal. Image: Capcom
What Capcom ID users should do now
Capcom says registered email addresses can keep being used, but warns the data “could be misused to send fraudulent emails or other communications impersonating Capcom or related parties.” Its advice: “If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.”
A practical checklist:
- Treat “Capcom” emails with suspicion. Capcom will contact affected users, so fakes may follow. Don’t sign in through email links; type cid.capcom.com yourself.
- Check you can still log in. If your password stopped working, you may be one of the 196 reset accounts; use the official support channels below.
- Turn on two-factor authentication. CAPCOM ID supports it (Capcom’s 2023 maintenance notice covers its recovery codes). Store your recovery code safely.
- Change reused passwords as a precaution. Capcom hasn’t confirmed any user-set password leaked, but if you use your CAPCOM ID password elsewhere, changing it is cheap insurance.
- Never reply with passwords or card details. Card data wasn’t part of this breach, so a message claiming otherwise is a red flag.
Capcom’s support channels for the incident:
- Japan: toll-free line 0120-801-271, 10:00 a.m. to 8:00 p.m. JST.
- Americas, and Europe/Middle East/Africa: the inquiry form at capcom-support.com. EMEA users can also email [email protected].
- Asia (excluding Japan) and Oceania: [email protected].
For general account-security steps, our guide to securing a Final Fantasy XIV account covers the same basic habits. More on CAPCOM ID games: Resident Evil 2, 3 and 4 on Switch 2, the Monster Hunter Wilds Switch 2 demo and the Street Fighter movie’s box office debut.
What’s next
Capcom’s investigation continues, so the October 22 figures could change. Affected users should watch for Capcom’s notification and check it against the official notice before acting. We’ll update this story if Capcom publishes new findings.
Sources: Capcom press release (October 22, 2026), CAPCOM ID announcements, VGC.
Live: Follow today’s gaming news as it happens
Featured image: Capcom
