Capcom Reports 11.77 Million Records Leaked in CAPCOM ID Breach
The exposed fields are login metadata (timestamps, login counts, last-login IP), which is the kind of data that makes credential-stuffing and impersonation phishing easier even with no password leak, and the breach lands in the same year CAPCOM ID passed 10 million registrations.
Key Facts
- Capcom announced on October 22, 2026 that unauthorised access to CAPCOM ID leaked 11,774,247 records worldwide.
- The leaked CAPCOM ID data includes email addresses, account creation and last-login timestamps, login counts, and the client IP address at last login.
- Dates of birth, gender, country or region, and nicknames were exposed for 43 of the leaked CAPCOM ID records.
- Login passwords were changed without authorisation on 196 CAPCOM ID accounts, and Capcom has reset those passwords.
- Capcom reported the CAPCOM ID breach to police and the Personal Information Protection Commission on October 21, 2026.
Reporting from 6 sources: GAME Watch (Impress), 4Gamer.net, KAI-YOU, Denfaminicogamer, and 2 more.
Capcom announced on October 22 that unauthorised third-party access to its CAPCOM ID account service leaked 11,774,247 records worldwide. The data includes email addresses, account creation and last-login timestamps, login counts, and the client IP address at last login. For 43 of those records, dates of birth, gender, country or region, and nicknames were also exposed. Login passwords were changed without authorisation on 196 accounts; Capcom has reset those passwords and says it has not confirmed any leak of user-set passwords. Credit card data is not part of the leaked set. Capcom found traces of the intrusion on October 19, set up an internal response headquarters on October 20, and reported to police and the Personal Information Protection Commission on October 21. Services using CAPCOM ID remain available, Capcom says gameplay is unaffected, and affected users will be contacted individually.
The 43 records that included birth dates and nicknames are a fraction of the 11,774,247 total, and the identification data in the wider set is login metadata: account creation date and time, last login date and time, login count, and the client IP address at last login.
Capcom is warning that the leaked addresses could be used for phishing. Users are asked not to open URLs or attachments in emails that claim to come from Capcom or related parties. A dedicated inquiry desk has been set up for Japan at 0120-801-271, open from 10:00 to 20:00, with separate support forms for North America and South America, EMEA, and Asia and Oceania.
The account service reached 10 million registered users in February 2026. Capcom says it will keep investigating the cause, consider measures to prevent recurrence, and strengthen its information security system, and will post further disclosures on its official site if new facts emerge. Capcom also suffered a third-party cyberattack in 2020 that caused internal system failures and leaked personal information, and in 2021 it published the results of an external specialist investigation and its recurrence measures.
Synthesized by Yomimono from the 6 cited sources below, including Japanese-language reporting where cited, then editorially reviewed before publishing.
Sources
- GAME Watch (Impress) カプコン、一部ユーザー情報が流出。「CAPCOM ID」に不正アクセス
- 4Gamer.net カプコンのオンライン会員サービス「CAPCOM ID」に不正アクセスが発生。メールアドレスなど1177万4247件が漏えい
- KAI-YOU カプコン「CAPCOM ID」に不正アクセス 約1177万件のメールアドレスなど流出
- Denfaminicogamer カプコンの「CAPCOM ID」に第三者による不正アクセス。メールアドレスとシステム固有の識別情報が全世界で1177万4247件漏えい
- ASCII.jp カプコン、1177万件超の顧客情報漏えい 「CAPCOM ID」に不正アクセス、パスワードの不正変更も
- Game Spark カプコンに不正アクセス、約1,177万件の大規模漏えい―「CAPCOM ID」の顧客情報が流出、196件でパスワード不正変更も