-
CAPCOM confirmed that unauthorized access exposed 11,774,247 records with email addresses and account details.
-
Another 43 records held personal details, and 196 accounts had their passwords changed without permission.
-
The company says users’ original passwords were not confirmed leaked, and credit card details were unaffected.
Japanese game maker CAPCOM has confirmed a data breach that touched millions of player accounts. The company shared the news in an official statement on October 22, 2026.
Someone gained access without permission to records linked to its CAPCOM ID membership service. The exposed items include email addresses, login history, and a small set of personal details. The company says its investigation is still going on.
Millions of Email Addresses and Login Details Exposed
According to CAPCOM, the breach affected 11,774,247 records. These records held email addresses and system details tied to accounts around the world. The details included account creation dates, last login dates, and login counts. They also included the IP addresses people used during their most recent logins.
An IP address is a number that shows which network a device used to go online. Login counts show how many times an account is signed in. CAPCOM listed both types of details among the exposed items.
CAPCOM ID is one account that opens the company’s web services and selected online games. Users who signed up for those services could therefore be affected. The company has not shared a country by country list of the affected records.
The breach also exposed extra personal details in 43 records. These covered dates of birth, gender, country or region, and nicknames. A security write-up of the case lists the same categories of data.
CAPCOM has not said how the intruder got in. It has also not said how long the intrusion lasted. The company says the full impact remains under investigation.
196 Accounts Had Their Passwords Changed Without Permission
CAPCOM also confirmed a second problem. In 196 CAPCOM ID accounts, someone changed the login passwords without approval. The company drew a clear line between a password change and a password theft. An unauthorized change means someone other than the owner set a new password.
A theft means someone copied the password the owner created. It says it has not confirmed any leak of the passwords users first created. It has already reset the passwords on all 196 accounts. So the passwords people chose for themselves were not confirmed stolen. Still, those 196 passwords did not change until CAPCOM stepped in. Credit card details were not part of the exposed data, according to CAPCOM.
The company noticed suspicious activity on October 19. It blocked unauthorized access right away. Then it began checking the cause and the possible damage. On October 20, CAPCOM set up an internal response team. The team formed after the company confirmed two facts. Some customer information had leaked, and some passwords had changed without approval.
CAPCOM reported the incident to the police and Japan’s Personal Information Protection Commission on October 21. It shared its findings with the public the next day, as shown in its disclosure update.
Three days passed between the discovery of the problem and the public announcement. The company says it has finished its emergency response steps. It also says it found and fixed the attack method. The investigation continues, though.
CAPCOM plans to strengthen its information security to lower the risk of similar incidents. CAPCOM ID services remain available, and the company says gameplay in its games was not affected. It will contact affected customers one by one.
CAPCOM Warns Users About Phishing Messages
The leaked data could still cause trouble for users. This holds even though CAPCOM reported no exposure of original passwords or card details. Email addresses paired with login history and IP addresses may help criminals write convincing phishing messages. Phishing means a fake message that tricks you into sharing private information.
Each detail looks small alone. Together, an email address, a login date, and an IP address give a scammer real facts to mention. A message with real facts can look genuine.
Attackers could pretend to be CAPCOM or a company linked to it. They may try to make users click harmful links. They could also push people to open bad attachments or hand over their account login details. Another report on the breach points to the same phishing risk.
CAPCOM warns users to watch for suspicious messages that claim to come from the company or its partners. It tells recipients not to open links or attachments in those emails. Users who hold a CAPCOM ID should treat unexpected emails with care. They should check account messages on CAPCOM’s official website. They should not rely on links sent in unexpected messages.
Reports also advise users to pick a different password for each service. They suggest turning on extra account security features where they exist. These steps help because one stolen password cannot then open other accounts. Extra security features add another lock, so a password alone cannot open the account.
The case shows that account details can create risk even when passwords and payment data stay safe. CAPCOM has fixed the immediate access problem. Further investigation may reveal the full scope and cause of the incident.
Another Japanese company, Askul, has confirmed that a RansomHouse cyberattack resulted in customer data being stolen, highlighting the risks data breaches pose to customers across different industries.
