Capcom: breach of CAPCOM ID service exposes 11.7 million email addresses and account details
Severity: medium · Patch status: no-fix-needed · Since 2026-10-24
Japanese gaming company Capcom disclosed unauthorized access to its CAPCOM ID online membership service, discovered on October 19, 2026. Attackers stole 11,774,247 email addresses worldwide along with account details including creation dates, last login dates, login counts, and latest-login IP addresses. In 43 cases, date of birth, gender, country/region, and nickname were exposed, and passwords were illegally changed on 196 accounts, which Capcom has reset. Services remain operational; Capcom activated incident response, notified authorities, established a task force, and is contacting affected customers. The company warns users of phishing emails impersonating Capcom. This follows Capcom's 2020 Ragnar Locker ransomware attack. No CVE applies; remediation is account resets and investigation.
What to do
- Reset CAPCOM ID passwords and enable unique credentials not reused elsewhere
- Be alert to phishing emails impersonating Capcom or its partners; avoid clicking links or attachments
- Monitor accounts for unauthorized activity and unexpected login notifications
- Watch for follow-up disclosures from Capcom regarding expanded scope of affected data
Sources
All live incidents on Threat Watch
