Capcom Confirms Data Breach Affecting 11.7 Million Capcom ID Accounts
Capcom has confirmed that a third party gained unauthorized access to customer information tied to Capcom ID, the company’s online membership service used across games including Street Fighter 6. The breach exposed email addresses and account identifiers for 11,774,247 records worldwide, the company said, though it has found no evidence that credit card details or original account passwords were compromised.
What Capcom found, and when
According to Capcom’s own disclosure, the company detected suspicious activity suggesting unauthorized access on October 19, 2026, and immediately began blocking it. By October 20, Capcom had set up an internal incident response headquarters, confirmed that customer information had been accessed, and found unauthorized password changes on a limited number of accounts. It reported the matter to its external Information Technology Security Oversight Committee the same day.
On October 21, Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission, the country’s data protection regulator. The company published its public notice the following day, October 22.
What data was exposed
Capcom’s disclosure breaks the exposure into tiers. Email addresses and system identifiers, including account creation date, last login date, number of logins and the IP address used at last login, were exposed for 11,774,247 records worldwide. Within that larger group, a much smaller set of 43 records also had date of birth, gender, country or region, and nickname exposed. Capcom said 196 accounts had unauthorized password changes, and it has reset passwords on those accounts.
Capcom said it has “not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves,” and that credit card information was not part of the breach. Services that use Capcom ID, including Street Fighter 6, remained available throughout.
What Capcom is doing about it
Capcom says it has completed emergency response measures and identified and addressed the method the attacker used. The company has set up dedicated customer support channels for Japan, the Americas, Europe, the Middle East and Africa, and Asia outside Japan, and says it will individually notify affected customers.
“Capcom takes this matter extremely seriously and will continue its detailed investigation,” the company said in its notice. It warned customers that the exposed data could be used to craft fraudulent emails impersonating Capcom, and advised against opening links or attachments in unexpected messages claiming to be from the company.
What Capcom ID is used for
Capcom ID is the single sign-on account system Capcom uses across its online services, linking a player’s profile, in-game purchases and progress across titles such as Street Fighter 6, Monster Hunter and Resident Evil’s online features. Because one Capcom ID can be tied to activity across several franchises, a breach of the account layer itself carries wider exposure than a breach limited to a single game’s servers, even when, as in this case, the exposed fields are largely limited to account metadata rather than passwords or payment details.
How this compares to other recent gaming breaches
Engadget reported that Rockstar Games confirmed a separate third-party data breach earlier this year, in April, as part of a wider pattern of major publishers disclosing unauthorized access to player account systems. Capcom itself has disclosed breaches before: a 2020 ransomware attack on the company exposed internal corporate data and some customer information, though that incident involved a different attack method than the one described in this week’s notice.
Capcom has not said how the attacker gained access this time, only that it has identified and addressed the method used. The company said its investigation is continuing and that it will provide updates as warranted.
Frequently asked questions
Was my credit card information stolen? No. Capcom says credit card information was not included in the data accessed.
Do I need to change my Capcom ID password? Capcom says it has not confirmed any compromise of customer-set login passwords, and has already reset passwords on the 196 accounts where unauthorized changes were detected. As a precaution, affected users may still want to change their password and watch for phishing emails impersonating Capcom.
Can I still play Street Fighter 6 and other Capcom ID games? Yes. Capcom says all services that use Capcom ID remained available throughout the incident.
What should I do if I get a suspicious email claiming to be from Capcom? Capcom’s own notice advises customers not to open URLs or attachments in unexpected messages claiming to be from the company, since the exposed email addresses and account details could be used to make phishing attempts look more convincing.
What to watch next
Capcom has said its investigation is ongoing, which typically means the scope of a breach notice can change in follow-up updates, as happened with the company’s 2020 incident. Watch for Capcom to confirm the attack method publicly, and for Japan’s Personal Information Protection Commission to weigh in on whether the company’s disclosure and response met regulatory requirements.
Source: Capcom.
Leave a Reply