Was Capcom ID Hacked? Breach Hits 11.7 Million Accounts

Capcom says a third party accessed customer data tied to Capcom ID, the account service needed to play certain Capcom games online. In a notice published October 22, 2026, the company said 11,774,247 records worldwide were affected. Credit card information was not included, and Capcom says its games and Capcom ID services remain available.

Here is what was exposed, per Capcom. All 11.77 million records include an email address plus the account creation time, last login time, number of logins and the IP address used at the last login. For 43 of those records, the date of birth, gender, country or region and nickname were accessed too. Capcom also confirmed that 196 accounts had their passwords changed without authorization. Those passwords have been reset. The company says it has not confirmed any compromise of the login passwords customers chose.

Capcom’s timeline starts on Monday, October 19, when it detected suspicious activity and began blocking the access. It set up an incident response headquarters on October 20. It reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21. Rock Paper Shotgun notes the service is required to play online in games like Street Fighter 6, which has its own Street Fighter 6 page on Pixel Herald. Capcom hasn’t said how the attacker got in. It says only that it has “identified and addressed the attack method.”

What you should do: Capcom says registered email addresses can keep being used, but the leaked details could be used to send fake messages that pretend to be from Capcom. Don’t open links or attachments in suspicious emails. Capcom says it will contact affected customers and has opened dedicated support channels, including a toll-free line in Japan and regional contacts listed in its notice. Windows Central suggests changing your password as a precaution, which is the writer’s advice, not Capcom’s.

We compared what Capcom’s notice lists with what phishers usually need. Email addresses and last-login IPs are not passwords, but together with login counts and account dates they let a scammer write a message that looks tailored to you. For example, a fake “account locked” email that mentions when you last logged in would be more convincing than a generic one. So go to Capcom’s site directly instead of clicking. If you reuse your Capcom ID password elsewhere, changing it is cheap insurance, even though Capcom reports no sign that customer-set passwords leaked. Capcom says it will post more facts if the investigation finds them, so the 11.77 million figure could still change.

Edited by Kerwin Stewart, Editor-in-Chief · How we report