Last updated: 26 October 2026. We update this post if Capcom publishes new figures.
Capcom has confirmed that attackers took 11,774,247 records from CAPCOM ID, the shared account service behind its web services and online play in some of its games. Each record holds an email address plus account metadata. That means when the account was created, when it last signed in, how often, and the IP address of that sign-in. That is not a password dump.
In our assessment it is still a ready-made target list for phishing and account takeover.
- 11,774,247Records with an email address and account metadata, worldwideSource: Capcom notices of 22 and 23 October 2026
- 43Of those records also held date of birth, gender, country or region, and nicknameSource: Capcom notices of 22 and 23 October 2026
- 196Accounts whose login password was changed without authorizationSource: Capcom notices of 22 and 23 October 2026
- 19Accounts among the 196 whose e-Capcom pages were accessed (Japan)Source: Capcom notices of 22 and 23 October 2026
What Capcom Says Was Taken
Capcom’s notice of 22 October says a third party gained unauthorized access to CAPCOM ID. The company detected suspicious activity on 19 October, blocked it and confirmed the same day that access had occurred. On 21 October it reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission.
The notice splits the loss in three. First, 11,774,247 worldwide records with an email address and four system fields. Second, 43 of those records with date of birth, gender, country or region and nickname. Third, 196 accounts whose passwords were changed without authorization.
Credit card data was not included, and Capcom says games and CAPCOM ID services still work.
On 23 October Capcom updated the notice. Of the 196 accounts, a third party had opened the e-Capcom account pages of 19, in Japan. e-Capcom is Capcom’s online store there.
Those pages showed name, phone number, address, gender, date of birth, purchase history, inquiry history and the saved address book. Capcom says the scope investigation is complete and that the password changes led to no data leak in the other 177 accounts.
Why a Login Date and an IP Address Matter
This section is our assessment, not Capcom’s. An email list alone is cheap. A list that also says who signed in recently is worth more, because the attacker can skip dead accounts and spend effort on live ones. The last login date and the login count do that sorting.
The account creation date lets a phishing mail sound personal. A lure can say “your account from 2019” or “your recent sign-in” and match what the reader remembers. The last sign-in IP usually points to a region and an internet provider, not to a street. Together the fields make a message look like it came from someone who knows the account.
Capcom’s own advice points the same way. Its first notice warns about suspicious emails that impersonate Capcom or related parties. The update widens that to fraudulent texts and phone calls. Both warnings tell readers not to open links or attachments in such messages.
| Field | Likely use | Why it helps an attacker |
|---|---|---|
| Email address | Phishing and password guessing | It is the username half of a sign-in |
| Last login date and login count | Picking live accounts | Active users are worth more effort than dead ones |
| Account creation date | Believable lures | A message can quote facts the reader recognizes |
| Last login IP | Rough location checks | It hints at a region and a provider |
From a Mail List to a Hijacked Account
Capcom says it has not confirmed any compromise of passwords that customers chose themselves. Our reading: the leaked list does not open accounts by itself. The risk comes from reuse: an email from this list paired with a password from another breach is the recipe for credential stuffing. The glossary gives a short definition of credential stuffing.
The 196 changed passwords show what a takeover looks like once it happens. The owner is locked out, and the attacker moves on to whatever the account opens. Here that was the store pages of 19 accounts.
A shared sign-in is convenient, but it also means one account takeover can reach every service behind it. Our account takeover lifecycle post follows that path.
Capcom’s notices do not describe how the attacker got in. They say only that the company has identified and addressed the attack method. We therefore do not link the password changes to any technique, and you should treat any such claim from other sources as unconfirmed.
What CAPCOM ID Holders Should Do
- Treat Capcom-themed messages as suspectDo not open links or attachments in suspicious emails or texts that claim to come from Capcom, and be wary of such calls. Capcom gives the same warning.
- Go to the site by typing the addressIf a message claims your account is affected, check capcom.co.jp or the regional support page yourself. Capcom says it will contact affected customers directly.
- Change reused passwordsIf your CAPCOM ID password is used anywhere else, change it on both sides and make each one unique.
- Turn on multi-factor authenticationUse it on your email account first, then on any service that offers it.
- Check the store accountIf you shop on e-Capcom, look through your order history and saved addresses for changes you did not make.
What Teams That Run Sign-In Systems Should Change
Treat login metadata as personal data. Fields such as last sign-in time, login count and IP address seem harmless in a database, yet Capcom’s case shows they leave with the email address. Keep only what a feature needs, and keep it for as long as it needs.
Check new passwords against known breached values. NIST SP 800-63B says verifiers must compare a new password against a blocklist of commonly used, expected or compromised passwords, for example passwords from previous breach corpuses. The OWASP Credential Stuffing Prevention Cheat Sheet calls multi-factor authentication by far the best defense against the majority of password-related attacks. It adds that the second factor can be required only for risky sign-ins, such as a new device or IP address.
Alert the user when a password changes. OWASP advises notifying users about unusual security events and holding access when several password resets arrive from different devices or IP addresses. Capcom’s 196 changed passwords are the kind of pattern such a rule is meant to catch. Make sure the alert goes to a channel the attacker does not control.
If your staff may have used work addresses for consumer accounts, expect lures that mention a gaming brand. Teams that want to know when company data or domains turn up in leaks can read how data leak detection works. For your own response steps after a leak, see the data breach response guide.