Video game publisher Capcom has confirmed that a security breach compromised the personal information of more than 11 million users. The company issued a public apology after unauthorized access was gained to its online membership service, known as CAPCOM ID. The incident, which the developer discovered on October 19, 2026, resulted in the leakage of email addresses and system-specific identification data.
Scope of the Capcom data breach
According to the company, the breach affected 11,774,247 accounts. The exposed data includes email addresses paired with system-generated information such as account creation timestamps, last login times, and client IP addresses. While the volume of affected records is high, the nature of the leaked data is primarily administrative rather than financial.
Capcom stated that no credit card information was included in the compromised dataset. This distinction is critical for users concerned about financial fraud. However, the exposure of email addresses and IP addresses can still facilitate targeted phishing campaigns or identity theft attempts. The company has completed emergency measures to identify the attack methods and has blocked further unauthorized access.
Compromised accounts and security response
While the majority of affected users had only administrative data exposed, a small subset of accounts faced more severe intrusion. Capcom reported that 43 accounts had additional personal details leaked, including dates of birth, gender, country of residence, and account nicknames. Furthermore, 196 accounts had their login passwords illegally changed by the attackers.
The company clarified that it has not confirmed any leaks of passwords set directly by customers. The passwords for the 196 compromised accounts have already been reset. Capcom created a dedicated task force on October 20 to gather information and prevent further damage. By October 21, the incident had been reported to the police and the Personal Information Protection Commission.
Users who were part of the breach will receive an official email from Capcom notifying them of the incident. The company is urging all users, particularly those affected, to remain vigilant. Capcom suspects that malicious actors may send suspicious emails impersonating the company or similar entities to trick users into revealing their credentials. Experts recommend that users set up unique passwords for different accounts and consider using a password manager to enhance their online security posture.
Source: PC Gamer
