Capcom Confirms Unauthorized Access to CAPCOM ID Data Affecting 11.77 Million Records
Summary
Capcom confirmed unauthorized access to its CAPCOM ID system involving 11.77 million user records. The records included email addresses and account activity; passwords set by users have not been confirmed leaked, and payment details were not exposed.
Key points
- Capcom detected suspicious activity on October 19, confirmed unauthorized access that day, and said the attacker obtained user data by October 20.
- The affected records mainly included email addresses and account activity, such as account creation time, last login, login count, and the client IP address of the last login.
- A further 43 records included birthdays, gender, country or region, and nicknames.
- The attacker changed passwords for 196 accounts; Capcom reset those passwords. Whether users' own passwords leaked remains unconfirmed.
- Capcom said linked payment details, including credit cards, were not exposed; its services and games remained operational.
- Capcom reported the incident to law enforcement and Japan's Personal Information Protection Commission, and said it would contact affected users by email.
Article Details
- Victim Organization
- Capcom
- Incident Type
- Unauthorized access and data breach involving the CAPCOM ID membership system
- Incident Date
- 2026-10-19
- Disclosure Date
- 2026-10-23
- Data Types Exposed
- Email addresses
- Account creation time
- Most recent login time
- Number of logins
- Client IP address of the last login
- For 43 records: birthdays, gender, country or region, and nicknames
- Affected Records
- 11.77 million user records worldwide; a further 43 records included birthdays, gender, country or region, and nicknames.
- Operational Impact
- CAPCOM ID services and games continued to work normally. Capcom reset the login passwords of 196 accounts after the attacker changed them. Capcom had not confirmed whether user-set passwords were exposed.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed