started · updated
Capcom confirms data breach affecting 11.7 million Capcom ID accounts
Japanese video game publisher Capcom has confirmed a major data breach affecting 11,774,247 Capcom ID records worldwide. The unauthorized access was first detected on October 19, 2026, prompting the company to establish an internal incident response headquarters and implement emergency security measures.
The breach primarily exposed email addresses and system metadata, including account creation dates, last login timestamps, login frequency, and the IP addresses used during the most recent connections. A smaller subset of 43 records contained additional personal information such as dates of birth, gender, country or region, and nicknames. Furthermore, attackers unauthorizedly changed passwords on 196 accounts; Capcom has since reset these credentials.
Capcom stated that the original passwords set by users were not compromised, and no credit card or banking information was affected. While online services and games like Street Fighter 6 and Monster Hunter Wilds remain operational, the company warned users to be vigilant against phishing attempts that may use the leaked information to impersonate official communications. The company has reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
Entities
CAPCOM ID · Capcom · Fuji Television · Japan · Monster Hunter Wilds · Osaka Prefectural Police · Personal Information Protection Commission · Personal Information Protection Commission of Japan · Street Fighter 6
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 30 SOURCES] Capcom confirmed a data breach affecting 11,774,247 Capcom ID records. hardzone.es · www.diarioestrategia.cl · es.digitaltrends.com · www.gamereactor.pl · arynews.tv · +24 more
- [● 18 SOURCES] Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. www.diarioestrategia.cl · es.digitaltrends.com · www.gamereactor.pl · arynews.tv · www.blogspan.net · +13 more
- [● 30 SOURCES] Unauthorized password changes occurred on 196 accounts. hardzone.es · www.diarioestrategia.cl · es.digitaltrends.com · www.gamereactor.pl · arynews.tv · +24 more
- [● 30 SOURCES] The breach included email addresses, account creation dates, last login times, and IP addresses. hardzone.es · www.diarioestrategia.cl · es.digitaltrends.com · www.gamereactor.pl · arynews.tv · +24 more
- [● 30 SOURCES] Credit card information was not affected by the breach. hardzone.es · www.diarioestrategia.cl · es.digitaltrends.com · www.gamereactor.pl · arynews.tv · +24 more
- [● 25 SOURCES] Users are warned to be cautious of phishing emails containing suspicious links or attachments. hardzone.es · es.digitaltrends.com · www.gamereactor.pl · www.gamereactor.eu · gamingbolt.com · +20 more
- [● 35 SOURCES] 43 records contained birth dates, gender, country/region, and nicknames. hardzone.es · www.diarioestrategia.cl · es.digitaltrends.com · www.gamereactor.pl · arynews.tv · +30 more
- [● 26 SOURCES] The company has identified and addressed the attack method. es.digitaltrends.com · www.gamereactor.pl · www.gamereactor.eu · gamingbolt.com · cyberinsider.com · +21 more
- [● 11 SOURCES] Credit card and banking information were not included in the breach. pixelcritics.com · cybernoz.com · losangelesweeklytimes.com · nationalcybersecurity.com · www.lowyat.net · +6 more
- [● 13 SOURCES] The breach included email addresses, account creation dates, login history, and IP addresses. pixelcritics.com · cybernoz.com · losangelesweeklytimes.com · nationalcybersecurity.com · www.lowyat.net · +8 more
- [● 12 SOURCES] The suspicious activity was first detected on October 19, 2026. pixelcritics.com · cybernoz.com · losangelesweeklytimes.com · nationalcybersecurity.com · www.lowyat.net · +7 more
- [● 2 SOURCES] Capcom has identified and addressed the attack method used in the incident. losangelesweeklytimes.com · www.lowyat.net