Capcom has confirmed a major cybersecurity incident affecting more than 11.7 million CAPCOM ID records worldwide. The breach exposed customer email addresses, IP addresses and account activity information, raising concerns about phishing attacks targeting players of some of gaming’s biggest franchises.
The Japanese game publisher behind Resident Evil, Monster Hunter and Street Fighter announced the incident on October 22, 2026, following an investigation into unauthorised access to its CAPCOM ID membership service.
The company says it has implemented emergency security measures and addressed the attack method. However, the incident highlights how valuable gaming accounts and player information have become to cybercriminals.
What Information Was Exposed?
According to Capcom’s official disclosure, unauthorised access affected 11,774,247 records worldwide.
The information exposed included:
- Email addresses registered with CAPCOM ID.
- Account creation dates and times.
- Last login dates and times.
- Number of account logins.
- IP addresses used during the most recent login.
Although the majority of affected records involved email addresses and account-related information, Capcom also confirmed additional exposure involving a smaller number of accounts.
For 43 accounts, the exposed information also included dates of birth, gender, country or region and account nicknames.
Capcom further confirmed that 196 accounts had their login passwords changed without authorisation. The company says those passwords have already been reset.
Importantly, Capcom has not confirmed that passwords originally created by customers were compromised. Credit-card information was not included in the affected data.
How Did the Attack Happen?
Capcom detected suspicious activity on October 19, 2026, and immediately began blocking unauthorised access while investigating the incident.
The company confirmed the breach on the same day.
On October 20, Capcom established an internal incident response team to investigate the attack, determine its scope and prevent further unauthorised access.
The following day, the company reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
Capcom says it has identified and addressed the attack method involved and completed emergency response measures.
However, the company has not publicly disclosed the identity of the attackers or provided a detailed technical explanation of the initial intrusion.
Why Gaming Accounts Are Valuable to Hackers
Gaming accounts may seem like low-value targets compared with banking or corporate systems, but they can contain information that is attractive to cybercriminals.
Email addresses, account identifiers and login activity can be used to build convincing phishing campaigns.
For example, an attacker could send a message pretending to come from Capcom, warning a player about suspicious activity or claiming that their account needs verification.
Because the attacker may already know that the recipient uses CAPCOM ID, the message can appear more believable.
Gaming accounts can also be connected to online services, digital purchases, game progress and other personal information.
The exposed IP addresses and account activity details add another layer of information that could potentially be used to make targeted messages more convincing.
The biggest concern for players now may be what happens after the breach: phishing and account-targeting attempts.
Which Games and Players Could Be Affected?
CAPCOM ID is a unified membership service used to access various Capcom websites and online services.
Depending on the game and service, players may use it for account management, community features and online-related functionality.
Capcom’s major franchises include:
- Resident Evil
- Monster Hunter
- Street Fighter
- Devil May Cry
- Exoprimal
Not every player of these games will necessarily have a CAPCOM ID account, and the breach does not mean that every game account or platform account has been compromised.
Capcom confirmed that services using CAPCOM ID, including games, remained available following its emergency response.
What Should CAPCOM ID Users Do?
Even if Capcom has not confirmed that your account was directly affected, taking a few precautions is sensible.
1. Watch your email
Be particularly careful with messages claiming to come from Capcom. Do not click unexpected account-verification links or open suspicious attachments.
2. Change your password
Consider changing your CAPCOM ID password through Capcom’s official website. Use a unique password that you do not reuse on other services.
3. Secure your email account
Your email account is often the key to resetting passwords on other services. Make sure it has a strong, unique password and multi-factor authentication where available.
4. Check for suspicious account activity
Look for unfamiliar login activity, unexpected password-reset messages or account changes you did not request.
5. Avoid fake support pages
Do not trust links in unsolicited emails or messages. Navigate to Capcom’s official website yourself if you need to check your account or contact support.
Capcom says it will contact affected customers and has established dedicated support channels for questions about the incident.
This Is Not Capcom’s First Major Security Incident
The latest breach is not the first time Capcom has faced a serious cybersecurity incident.
In November 2020, the company suffered a ransomware attack attributed to the Ragnar Locker group. That incident involved the theft of a substantial amount of company data, including personal and business information.
The 2026 incident is separate, and Capcom has not publicly attributed it to the same group.
The repeated incidents demonstrate the continuing security challenges faced by major gaming companies, particularly those operating large online platforms and account services.
Final Verdict: A Serious Warning for the Gaming Industry
The Capcom breach is a reminder that cybersecurity risks extend far beyond banks, government agencies and large technology companies.
Gaming publishers hold enormous amounts of customer information, and their account platforms can become attractive targets for attackers.
With more than 11.7 million affected records, this incident is significant even though Capcom says customer-created passwords and credit-card information were not confirmed compromised.
For players, the immediate priority is to stay alert for suspicious messages, secure their accounts and avoid reusing passwords.
For the gaming industry, the message is clear: protecting player data must be treated as seriously as protecting the games and services themselves.
Have you received an email from Capcom about this incident? Let us know in the comments.
Sources
- Capcom — Official Notice and Apology Regarding Customer Information, October 22, 2026
- Video Games Chronicle — Capcom confirms breach affecting more than 11 million CAPCOM ID accounts
- PC Gamer — Capcom confirms data breach affecting over 11 million users
This article is based on Capcom’s public disclosure dated October 22, 2026, and reporting available as of November 1, 2026.
