Capcom Confirms CAPCOM ID Breach: What Players Need to Know

On October 22, 2026, Capcom disclosed that a third party gained unauthorized access to data tied to 11,774,247 CAPCOM ID accounts worldwide. The exposed records include email addresses and login metadata, and 196 accounts had their passwords changed without permission. Capcom says credit card information was not part of the affected data.

CAPCOM ID is the publisher's unified account for its web services and is required for online features in some Capcom games, including Street Fighter 6 and Monster Hunter Wilds. If you play those titles online on PC or console, this one is worth a few minutes of your time.

Timeline

Capcom outlined the incident day by day:

October 19: Capcom detected suspicious activity, started blocking access and confirmed the intrusion the same day.
October 20: An internal incident response headquarters was set up, and the company reported the case to its external IT security oversight committee.
October 21: Capcom notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
October 22: The public notice went live.

Capcom has not explained how the attacker got in. All figures are as of October 22, and the investigation is still ongoing.

What was exposed

Data accessed	Records
Email address, account creation date, last login time, login count, IP address of last login	11,774,247
Also date of birth, gender, country or region, nickname	43
Password changed without authorization	196

The 43 and 196 figures are subsets of the main total, not additions to it. Capcom has already reset the passwords on the 196 affected accounts and says it has not confirmed that any passwords set by customers were compromised.

The company also says the incident does not affect access to its games or services, and players can keep using their registered email address.

How the breach could affect players

An email address on its own will not unlock your account, but it tells scammers exactly who owns a CAPCOM ID. That makes convincing phishing much easier, and Capcom itself warns players about messages impersonating the company.

Educational diagram showing the warning signs of a suspicious email impersonating Capcom

How to protect your account

Ignore links and attachments in emails or messages about your CAPCOM ID. Capcom says it will contact affected customers directly, but sign in by typing the official address yourself.
Retire reused passwords. If your CAPCOM ID password matches the one on your email, Steam or other gaming accounts, change it everywhere it appears.
Watch for login alerts or password reset notices you did not trigger, and contact Capcom support if anything looks off. Players in the Middle East can use the inquiry form at capcom-support.com or the feedback address listed in the notice.
Turn on two-factor authentication for your email and Steam account so a successful phishing attempt does not cost you your main inbox.

Not Capcom's first incident

Capcom was hit by a ransomware attack in November 2020. Its follow-up investigation counted 16,415 people whose personal information was compromised. The new case is far larger in scale and, unlike 2020, targets player accounts directly.