CONFIRMED
Capcom has confirmed that a third party gained unauthorized access to customer information tied to CAPCOM ID, affecting 11,774,247 records worldwide. The company says email addresses and login-related data were exposed, but no credit card information was affected. Capcom is also warning users to watch out for phishing emails.
What we know
Capcom’s official notice, published October 22, 2026 in Japanese and English, says an outside party accessed customer information connected to CAPCOM ID, the company’s online membership service. Capcom apologized in the notice. If you play Street Fighter 6 online, you almost certainly have one: as VGC points out, CAPCOM ID is the free account some Capcom games require for online features.
According to Capcom, the 11,774,247 affected records contained email addresses plus what it calls system identifier data. That covers account creation time, last login time, login count and the IP address used at your last login.
A much smaller group got hit harder. Capcom’s notice, also reported by VGC, says 43 of those records additionally exposed date of birth, gender, country or region, and nickname.
On passwords, Capcom is precise. It says it has not confirmed any compromise of passwords that customers set themselves. It did confirm that the attacker changed the passwords on 196 accounts without authorization, and those passwords have since been reset.
Card data appears safe. VGC reports Capcom’s statement that no credit card information was affected, and TheGamer quotes Capcom saying the same. Capcom will notify affected customers individually.
The timeline, according to Capcom’s notice as relayed by Notebookcheck and BigGo Finance: signs of unauthorized access were detected and blocked on October 19. An internal response headquarters was set up on October 20. On October 21, Capcom reported the incident to police and to Japan’s Personal Information Protection Commission.
Capcom also says services using CAPCOM ID remain available and that your ability to access or play its games is unaffected.
Some headlines have muddied this. TheGamer’s title references “Customer Passwords,” which implies your own password leaked. Capcom’s notice does not say that. The only confirmed password issue is the 196 accounts the attacker tampered with.
What we don’t know yet
Capcom has said it detected the unauthorized access on October 19, but it has not said when the access originally began. The attacker’s identity and the method of attack have not been disclosed in the sources we reviewed, and Capcom says it is still identifying how the attack worked.
Capcom describes its investigation into the full scope as ongoing, so the numbers could still change. It says it will take measures to prevent a recurrence but has not detailed them.
What it means
The short version: if you have a CAPCOM ID, assume your email address is in that pile. Capcom says it will contact affected users individually, but with nearly 11.8 million records involved, the safest move is to act now rather than wait.
Change your CAPCOM ID password anyway, even though Capcom has not confirmed customer-set passwords were compromised. If you reused that password anywhere else, change it there too. It is cheap insurance.
The bigger risk is phishing. A leaked email address paired with real details like your last login time makes a scam message look very convincing. Capcom itself is warning about phishing emails. Be suspicious of any message claiming to be from Capcom that asks you to click a link, log in or “verify” your account. Go to the site directly instead.
The 43 users whose birth date, gender, region and nickname were exposed should be especially careful, since that is enough personal detail to make targeted scams more believable.
This is not Capcom’s first rodeo, sadly. Tom’s Guide reported that in the 2020 ransomware attack, Capcom said up to 350,000 people in Japan and North America may have had data compromised. This new incident involves far more records, though the data exposed is mostly email and login metadata rather than deeper personal files.
For now, your games still work, your card details appear safe, and the real job is staying sharp in your inbox. We will update once Capcom shares how the attackers got in.
Follow every development in one place on our Resident Evil tracker.