Bad news for everyone who plays Capcom games online: Unauthorized individuals have gained access to the Capcom ID membership service. According to Capcom, 11,774,247 accounts are affected. Capcom ID is the free account you need for online features in some Capcom games, such as Street Fighter 6.
What Data Was Leaked in the Capcom Data Breach?
For all 11.77 million accounts, the attackers obtained email addresses, along with system data: account creation date, time of last login, number of logins, and the IP address of the last login.
For 43 accounts, the breach went further: birth date, gender, country or region, and nickname were additionally affected. According to Capcom, credit card details were not involved.
For 196 accounts, passwords were changed without authorization. Capcom has already reset these passwords. According to current information, user-set passwords were not compromised. All other users can continue to use their Capcom ID normally, according to the report.
How Did the Incident Unfold?
Capcom detected the unauthorized access on October 19, 2026, and immediately blocked it. On October 20, the publisher established a task force, and on October 21, the incident was reported to the police and the Japanese Personal Information Protection Commission (PPC). The investigation is ongoing, and Capcom has publicly apologized to its customers. Those affected are expected to receive an email notification.
What Does the Capcom Data Breach Mean for Me as a Player?
The biggest risk is phishing. Capcom itself warns: Because attackers know your email address, fake emails in the name of Capcom or similar companies might land in your inbox. Do not click on links in suspicious messages and do not open attachments.
From our perspective, this is a good opportunity for a quick security check. Use a unique password for each service, utilize a password manager, and activate two-factor authentication wherever possible. If you have used your Capcom password elsewhere, change it there as well. While Capcom states that user-set passwords were not compromised, caution costs nothing.
And for context: This is not Capcom's first major security incident. In November 2020, the publisher was the victim of a ransomware attack, during which, according to VGC, hundreds of thousands of personal data records were exfiltrated, including names and addresses of customers and former employees. That was a different incident from the current one.
Capcom announces that, upon completion of the investigation, it will take measures to prevent a recurrence and further strengthen information security. The company intends to publish new findings on its official website.
Do you have a Capcom ID? Let us know in the comments if you've already received a notification.
Comments (0)
No comments yet — be the first to share your take.