Capcom ID Data Breach Impacts 11 Million Users
Capcom has disclosed a data breach affecting the CAPCOM ID service, exposing email addresses and other account information for over 11 million users.
Japanese gaming giant Capcom has announced a significant data breach that has compromised the personal information of over 11 million users of its CAPCOM ID service. The incident, discovered on October 19, involved unauthorized access to the company's shared service, which is used for accessing online features and playing games.
During the intrusion, attackers managed to steal the email addresses of 11,774,247 individuals. In addition to email addresses, the compromised data includes account metadata such as the date of account creation, last login date, the total number of logins, and the IP address from which the last login occurred. This information could be used for targeted phishing campaigns or to attempt credential stuffing attacks on other services.
While the majority of affected users only had their email addresses and account metadata exposed, a smaller subset of 43 customers experienced a more severe compromise. For these individuals, attackers also accessed their dates of birth, gender information, country/region details, and nicknames. Capcom has stated that no user passwords were directly compromised, but the attackers did manage to change the CAPCOM ID account passwords for 196 affected users. The company has since reset these passwords.
Capcom has implemented its incident response measures and confirmed that all services utilizing CAPCOM ID remain operational. The company has begun contacting affected customers directly and has established a dedicated point of contact for any inquiries related to the breach. They have also reported the incident to the relevant regulatory authorities and are continuing their investigation into the full scope and the specific attack vector used.
In response to the breach, Capcom is advising affected users to remain vigilant against unsolicited email messages that may impersonate the company or its affiliates. Users are cautioned to be wary of suspicious URLs or attachments within such communications, as these could be part of phishing attempts leveraging the stolen information.
Capcom has pledged to take this incident seriously, conducting detailed surveys to identify the root causes. Based on these findings, the company plans to implement measures to prevent recurrence and further strengthen its overall information security systems. This breach adds to a growing list of high-profile incidents affecting the gaming and entertainment industries, highlighting the persistent threat landscape.
The incident underscores the critical importance of robust security practices for online services, especially those that aggregate user data across multiple platforms. The scale of the breach, impacting over 11 million users, serves as a stark reminder for organizations to continuously review and enhance their cybersecurity defenses to protect sensitive customer information.
The breach, which occurred on October 19, 2026, exposed 11,774,247 CAPCOM ID accounts globally. In addition to email addresses and account metadata, a subset of 43 records also included dates of birth, gender, country, and nicknames. While no evidence suggests customer passwords were compromised, 196 accounts had their passwords reset due to unauthorized changes by the attackers.