Capcom confirmed on 22 October 2026 that customer information tied to CAPCOM ID, its unified online membership account, was subject to unauthorized access by a third party. The confirmed scale is 11,774,247 records worldwide: email addresses plus system-specific identifier information. The part that changes how players should react is the composition of that total. For all but a tiny fraction, the exposure is an email address tied to login metadata, not a password or a payment card. Credit card information was not included, and Capcom has not confirmed that any customer-set password was compromised. The real consumer risk Capcom itself names is phishing: attackers now hold 11.7 million valid gamer email addresses.
What Capcom confirmed
CAPCOM ID is the free account needed to access online features of some Capcom games, such as Street Fighter 6, the example Video Games Chronicle gives. Capcom detected suspicious activity indicating potential unauthorized access on 19 October, immediately began blocking the access, confirmed on the same day that unauthorized access had occurred, and implemented emergency measures. On 20 October it established an internal incident response headquarters and confirmed the data impact of that access: certain customer information registered with CAPCOM ID had been subject to unauthorized access, and passwords associated with a limited number of accounts had been changed without authorization. It also reported to its external Information Technology Security Oversight Committee that day. On 21 October it reported to Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Public disclosure followed on 22 October. The dates alone carry the timeline: detection, blocking, and confirmation of the access on 19 October; confirmation of the data impact on 20 October; police and regulator notification on 21 October; public disclosure on 22 October.
The confirmed figures, as of 22 October, are: 11,774,247 records of email addresses plus system-specific identifier information, where the identifier information means date and time of account creation, date and time of last login, number of logins, and client IP address used during last login. Of those records, 43 also included date of birth, gender, country or region, and nickname. Separately, 196 accounts had their CAPCOM ID login passwords changed without authorization, and Capcom has already reset those passwords. A password changed without authorization and an original password leaking are two different things: the first means the password on the account was changed without the owner’s authorization, while Capcom has not confirmed that any password originally set by a customer was compromised. Capcom has completed the necessary emergency response measures, services using CAPCOM ID remain available, email addresses registered with CAPCOM ID may continue to be used without interruption, and the incident does not affect players’ ability to access or play any Capcom games. Capcom says it will notify customers affected by this incident and has established dedicated customer-support channels for Japan, North, Central and South America, Europe, Middle East and Africa, and Asia (excluding Japan) and Oceania. Capcom disclosed only a worldwide total and did not provide a breakdown by country or region, so the number of affected users in any single country, including the US, cannot be determined from the announcement alone.
What the numbers actually mean
Our own calculation from Capcom’s confirmed figures, with percentages as TechReview’s arithmetic rather than Capcom’s, shows why the phishing warning matters more than a password warning for most players.
| Slice of the 11,774,247 records | Count | Share of total |
|---|---|---|
| Email address plus system identifiers | 11,774,247 | 100% |
| Also date of birth, gender, country or region, nickname | 43 | About 0.0004% |
| Password changed without authorization (already reset) | 196 | About 0.0017% |
| Credit card data included | 0 (Capcom: not included) | 0% |
| Customer-set passwords confirmed compromised | 0 confirmed (Capcom: “has not confirmed”) | None confirmed* |
*”None confirmed” does not mean definitely zero. Capcom has not confirmed any compromise of customer-set passwords, and its notice does not say whether password hashes were accessed. The 0% for credit card data, by contrast, is a confirmed zero: Capcom states credit card information was not included.
TechReview analysis: this Capcom data breach is best understood as an email-address exposure at massive scale, not a password breach. Only the 196 reset accounts needed a password change from Capcom’s side. For everyone else, the exposure that matters is an email address an attacker can now pair with login metadata to craft convincing fake Capcom messages. That is exactly the misuse Capcom warned about: fraudulent emails or other communications impersonating Capcom or related parties. Capcom advised recipients of suspicious emails or messages not to access URLs in them or open attached files.
What should CAPCOM ID players do?
CAPCOM ID players should ignore links and attachments in any Capcom-looking email, go to the CAPCOM ID site directly instead, and change their password only if it is reused anywhere else, because Capcom has not confirmed that user-set passwords were compromised.
- Delete emails claiming to be from Capcom that ask you to click a link or open an attachment.
- Open the CAPCOM ID site directly in your browser instead of following any link in an email.
- Change your CAPCOM ID password if you reuse it on any other site or service.
- Watch for phishing messages that use your email address and gaming details to look legitimate.
- Wait for Capcom’s own notification before assuming your account was among the 196 that were reset.
If personal information from any breach is involved, the general steps in our data breach guide still apply: what to freeze, what to monitor, and who to call first. Read our data breach guide: what to do if your personal information was leaked, and follow our 2026 data breach tracker for confirmed incidents as they develop.
What is still unknown
Capcom says it identified and addressed the method of attack, but it has not publicly stated what the method was, so any report naming a specific intrusion method is not based on Capcom’s notice. No attacker or group has been named in Capcom’s notice or in the coverage checked for this article. Capcom has not confirmed compromise of user-set passwords, but its notice does not explicitly say whether password hashes were accessed, so this article does not describe passwords or hashes as safe. Capcom says the investigation into the scope of impact is ongoing, so the 11,774,247, 43, and 196 figures are as of 22 October and could be revised. Capcom reports records and accounts, not a count of distinct individuals, so this article does not convert the total into a count of people. This article will be updated on the same page if Capcom revises the figures or names an attack method or attacker.
Sources: Capcom, “Notice and Apology Regarding Customer Information Affected Through Unauthorized Access”, 22 Oct 2026 (every figure, date, and statement in this article comes from this notice); Video Games Chronicle, “Capcom says a data breach affected more than 11 million Capcom ID accounts, credit card details unaffected”, 22 Oct 2026 (corroborates the figures and gives the Street Fighter 6 example; its “credit card details unaffected” headline reflects Capcom’s own statement, not a separate finding); Notebookcheck, “Capcom confirms major data breach affecting more than 11.7 million Capcom ID accounts worldwide”, 22 Oct 2026 (corroborates the figures and timeline); Inven Global, “Capcom Cyberattack Exposes 11.77 Million CAPCOM ID Records, Including Emails”, 22 Oct 2026 (worldwide total only, no country breakdown).
