The Capcom ID data breach is real and large: 11,774,247 accounts. On October 22, 2026, Capcom published a "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access" on its investor relations news page, saying a third party got into data tied to Capcom ID, the account you need for online play in games such as Street Fighter 6. Email addresses were exposed for every affected account. Passwords were not confirmed stolen, and payment cards were not involved.
That sounds mild until you count what an email list is worth to a scammer: a list of 11 million people who bought Resident Evil, Monster Hunter or Street Fighter, and who will open an email that looks like it came from Capcom. Capcom says as much in its own warning. Below: exactly what the company says leaked, what it does not say, how this differs from Capcom's 2020 ransomware attack, and a short checklist you can finish in ten minutes.
TL;DR: what do Capcom ID holders need to know?
| Question | Direct answer |
|---|---|
| How many accounts? | 11,774,247 Capcom ID accounts, per Capcom's notice. |
| What was exposed for all of them? | Email addresses and "system-specific identifier information". |
| Anything extra for some accounts? | 43 accounts also had date of birth, gender, country/region and nickname records accessed. |
| Were passwords stolen? | Capcom has not confirmed compromise of customer-set passwords. |
| Any account takeover? | Passwords were changed without authorization on 196 accounts; Capcom says they are already reset. |
| Credit cards? | Not included, per Capcom. |
| When was it found? | Suspicious activity first noticed October 19, 2026; notice published October 22. |
| Biggest remaining risk? | Phishing emails or messages impersonating Capcom. |
What did Capcom actually say happened?
The core facts come from Capcom's press release, as relayed by Rock Paper Shotgun (we could not load the full release text from Capcom's page, so details beyond the headline are attributed to that coverage). Capcom says it noticed "suspicious activity" around the Capcom ID service on October 19, then spent the following days containing the problem. The company says it has "identified and addressed the attack method involved in this incident" and has reported the case to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.
The scope breaks into three layers:
- Everyone affected (11,774,247 accounts): email addresses and system-specific identifier information. That second phrase is vague by design; it most likely means internal account IDs, but Capcom has not defined it in the coverage we could read.
- A tiny subset (43 accounts): additionally, date of birth, gender, country or region, and nickname records.
- A smaller group again (196 accounts): passwords changed without authorization. Capcom says those passwords have already been reset.
Nintendo Life's write-up adds that the leak includes client IP addresses from the last login and account creation dates, and quotes Capcom's line "We would like to sincerely apologize". We have not been able to confirm those two extra fields in Capcom's own text, so treat them as one outlet's reading until the full notice is checked. If you want a conservative assumption, plan around them being possible.
"Capcom has not confirmed any compromise of Capcom ID account login passwords originally set by customers themselves. However, the company has confirmed that passwords were changed without authorisation on 196 accounts."
That quote, as reproduced by Rock Paper Shotgun, is the single most important sentence in the notice, and also the one with the most room in it. "Not confirmed" is not "confirmed not". The 196 unauthorized password changes mean someone had a way to act on at least some accounts, not just read a database.
Is this the same as Capcom's 2020 hack?
No, and the difference matters. In November 2020 Capcom was hit by a Ragnar Locker ransomware attack on its internal network; the company later said personal information of roughly 390,000 people, mostly business partners, employees and applicants, may have been affected, while customer-facing systems such as web stores and game servers were reportedly not compromised (Siliconera's coverage of Capcom's updates). That was an internal-network incident.
The October 2026 incident is aimed squarely at the customer account service. That is why the headline number jumped from hundreds of thousands to 11.77 million, and why the realistic harm is account-level: phishing, credential-stuffing attempts and spam, rather than corporate document leaks. Capcom has not said who is behind the 2026 incident, whether data is being sold, or whether any ransom was demanded. Anyone claiming those details today is guessing.
How worried should you be if your password was not stolen?
Moderately, and mostly about email. An email address plus the knowledge that you own a particular publisher's games is the raw material for a believable phish: "Your Capcom ID needs verification," "Claim your breach compensation," "Resident Evil Requiem account locked." Capcom itself spells this out:
"Email addresses registered with Capcom ID may continue to be used without interruption. However, there is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties. If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files."
Three practical consequences follow:
- Expect fake "breach notification" emails. Capcom says it will notify affected customers, and scammers know that. A genuine notice will not ask for your password, payment details or a "verification" login on an unfamiliar page.
- Reused passwords are the real exposure. If your Capcom ID password is also your password somewhere else, the other site is the bigger risk.
- Linked accounts deserve a glance. Capcom ID connects to storefront and platform features. Check your Steam, PlayStation or Xbox account for unfamiliar sign-ins, because those are worth more to a thief than a Capcom login.
For context on how fast scammers move around a gaming headline, see our earlier warning about fake GTA 6 leak downloads and the Meccha Chameleon malware and Discord breach story: the pattern is always the same, a real incident followed by a wave of copycat bait.
What should you do today? A ten-minute checklist
- Change your Capcom ID password at Capcom's official site, reached by typing the address or using your own bookmark, never from an email link. Use a unique password from a password manager.
- Change the same password anywhere you reused it. Start with your email account, then Steam, PlayStation Network, Xbox and Nintendo accounts.
- Turn on two-factor authentication on your email and on every gaming platform account that offers it. Email is the key to all password resets, so lock it first.
- Check your Capcom ID sign-in and purchase history for anything you do not recognize. If your password was among the 196 changed without authorization, you may already have been logged out.
- Treat every Capcom-flavored email as suspicious for the next few weeks. Do not click links or open attachments; go to the site yourself.
- Check whether the email is in a known breach database such as Have I Been Pwned if you want an independent signal, though a new incident can take time to show up.
- Tell friends and teammates. If your group plays Street Fighter 6 or Monster Hunter together, one person on a reused password is a risk to the whole friends list.
Why do these publisher breaches keep happening?
A publisher account system is a juicy target. It holds tens of millions of verified emails, it is often bolted onto older infrastructure, and the data it holds, an email, an ID, a region, is cheap to steal and easy to monetize through phishing. Capcom's own description, that it "identified and addressed the attack method", suggests a specific technical flaw rather than a stolen employee login, but the company has not said what that method was.
The other lesson is about timing. Capcom noticed suspicious activity on October 19 and published on October 22, three days later. That is quick by corporate standards and slow by phisher standards. During those days the exposed addresses were already valuable. Regulators in Japan are now involved, and a "detailed investigation" will follow, so expect the number or the description of the data to be revised.
What we still do not know
- What "system-specific identifier information" means in practice, and whether it could be linked to purchases.
- Whether IP addresses and account creation dates were included, as Nintendo Life reports.
- The attack method and the attacker. Capcom says the method was addressed but has not described it.
- How the 196 password changes happened, and whether they point to credential stuffing, a reset-flow bug or direct database access.
- Whether notified customers will be offered anything, such as monitoring or compensation. Capcom only says it will notify affected customers.
Other game news today
Valve developer slips the name "HLX" at a conference. On October 22, Valve audio lead Mike Morasky mentioned "HLX" during a GameSoundCon panel; we break it down in our Half-Life HLX explainer.
Peak lands on Xbox Series X|S. The co-op climbing hit launched on Xbox on October 22 at $9.99 with every content update included, crossplay and proximity chat, according to Xbox Wire. Multiplayer is friends-only for up to four players in total. If that is your group's next game night, our games like PEAK list has the alternatives.
Dispatch turns one and heads to phones. AdHoc Studio's superhero workplace comedy added storyboard and commentary modes on October 22, included in the deluxe edition upgrade at $10.99, and comes to iOS and Android on December 9, with the first four episodes free and the rest $19.99, per Game Informer.
Battlefront 3 is reportedly a DICE and Respawn project. Variety's sources, relayed by Eurogamer, say the two EA studios are co-developing it; EA only confirmed that the studios are collaborating. It lands in the wake of the BioWare closure.
Related reading
- EA is closing BioWare and cancelling Mass Effect 5
- PHP vulnerability outages: Pokémon, Cygames and GOG offline
- Meccha Chameleon malware and Discord hack
- Fake GTA 6 leak torrent malware scam warning
- Capcom IR news page with the October 22 notice
- Rock Paper Shotgun on the Capcom ID breach
Facts are accurate as of October 23, 2026. Capcom's investigation is ongoing, so account counts and data descriptions may change; check Capcom's notice and your own account security settings for the latest.