Hackers breached Capcom’s CAPCOM ID account system and accessed data from 11.7 million accounts. Exposed data includes email addresses, account creation dates, last login timestamps, login counts, and last-login IP addresses. For 43 accounts, additional details including dates of birth, gender, and country were accessed. For 196 accounts, the attackers actively changed login passwords. Capcom has reset those passwords and says online services are unaffected. No group has claimed responsibility.
What CAPCOM ID Is and Why It Matters
CAPCOM ID is Capcom’s shared account system. It’s not just a newsletter subscription or a contact database. It’s the login you use to access Capcom’s web services and play some of its online games , titles like Monster Hunter, Resident Evil, and others that require an account for online features.
That scope means the breach potentially touches people who have been actively playing Capcom’s online games, not just inactive customers from a long-ago sign-up. If you’ve logged into any Capcom service that requires a CAPCOM ID, your account may be in the affected dataset.
Capcom is one of the largest video game publishers in the world , 4,000 employees, $1.24 billion in annual revenue, franchises including Resident Evil, Monster Hunter, Street Fighter, and Mega Man. Those franchises have active global player bases, which explains how a single account system breach reaches 11.7 million people.
What Was Taken and What Wasn’t
The exposed data for the majority of accounts includes:
- Email address
- Account creation date
- Last login timestamp
- Number of times the account has been logged into
- IP address used at the last login
That list might look routine at first glance. It isn’t.
The last-login IP address is the detail worth pausing on. An IP address isn’t a GPS coordinate, but it can reveal roughly where you live, your internet service provider, and in some cases, whether you’ve been using a VPN or not. For people who play games under a username they keep separate from their real identity, having their last IP address in a breach database is a meaningful deanonymisation risk. It connects the in-game identity to a real-world location.
Passwords were not accessed, which Capcom explicitly confirmed. Credit card information was not affected, which matters for the large number of people who have purchase histories with Capcom’s digital storefronts.
The Two Subsets That Need Closer Attention
Two smaller groups within the 11.7 million are in a different position from everyone else.
For 43 accounts, the attackers accessed additional personal data: dates of birth, gender, nicknames, and countries. That’s more than enough to build a targeted impersonation or phishing profile. If your account was among those 43, you can expect Capcom will contact you directly.
More concerning is the second group: 196 accounts where attackers actively changed the login password. This wasn’t passive data collection. Someone decided to lock those specific account holders out, which suggests those accounts were specifically targeted , perhaps because they had purchase histories, stored data, or were associated with identities the attackers wanted to control or access further.
Capcom says it has already identified and reset the passwords on those 196 accounts, so the owners should now be able to log in normally. But the fact that specific accounts were deliberately hijacked, rather than data being extracted passively, indicates a level of active engagement with the breach that goes beyond simple database scraping.
This is the same pattern we saw in the Substack breach earlier this year, where 663,000 email addresses circulated with associated account data, even without passwords, the combination of email, IP, and login history creates a meaningful attack surface for follow-on phishing.
Capcom Has Been Here Before
This is not Capcom’s first significant security incident, and the 2020 case is worth revisiting because it shows how long these things can run.
In November 2020, the Ragnar Locker ransomware group attacked Capcom’s internal networks and claimed to have stolen 1 terabyte of data. The company eventually disclosed that up to 390,000 people could be affected. The initial access method wasn’t disclosed until April 2021, five months later , when Capcom confirmed the attackers had gained entry through an old VPN device that had been left in use
The current breach has a similar information gap: Capcom says it has identified the intrusion method and implemented countermeasures, but has not shared any details about how the attackers got in. Given what happened after 2020, most players will be watching for a follow-up disclosure.
As we’ve covered in looking at how early warning signs of breaches surface on the dark web before public disclosure, the gap between when an attacker enters a system and when the company finds out is often where the real damage happens. Capcom’s October 19 detection date and October 22 public disclosure is a reasonably fast turnaround but the breach could have been active for some time before that detection.
What Capcom Is Doing
The company filed a report with Japan’s Personal Information Protection Commission, which is the required regulatory response under Japanese data protection law. It has also notified local police.
Online services remain available. Capcom’s active games Monster Hunter Wilds, Resident Evil Village’s online features, and others, are not reported to be disrupted.
Capcom is notifying affected customers in stages, which is common when the number of affected accounts makes simultaneous notification impractical. The company has established region-specific support channels for customers with questions. Affected users should watch for official communication from Capcom’s actual domain, not from messages claiming to be from Capcom that arrive unsolicited.
What CAPCOM ID Users Should Do Right Now
Even if passwords weren’t stolen, there are concrete steps worth taking now.
Change your CAPCOM ID password anyway. Even without direct password exposure, the breach has established that attackers were inside the CAPCOM ID system. A fresh password costs nothing and removes any residual risk from the period of unauthorized access.
Enable two-factor authentication if CAPCOM ID offers it. Two-factor authentication means a stolen password alone can’t get someone into your account. If you haven’t set this up, do it now.
Watch for phishing attempts using Capcom branding. With 11.7 million email addresses now in the wild, expect phishing emails impersonating Capcom support. Any email claiming there’s a problem with your account, asking you to click a link to verify your identity, or requesting additional information should be treated with suspicion. Go directly to capcom.co.jp or the official game client to check your account status rather than clicking email links.
Check if your email appears in other known breaches. Go to Have I Been Pwned and enter your CAPCOM ID email address. If the Capcom dataset is added to their database, you’ll see it there. More usefully, you’ll also see if that same email address appeared in other breaches and if it did, any account using the same password as those breached services is now at additional risk.
For a full checklist of what to do when your personal data may be circulating online, our dark web data exposure guide covers the steps in the order that matters.
Frequently Asked Questions
What is CAPCOM ID?
Capcom’s shared account system used to access its web services and play some of its online games.
What data was exposed?
Email addresses, account creation dates, last login timestamps, login counts, and last-login IP addresses for 11.7 million accounts. For 43 accounts, additional details including date of birth, gender, and country.
Were passwords or payment cards taken?
No. Capcom confirmed that passwords for the vast majority of accounts were not accessed, and credit card information was not affected.
What happened to the 196 accounts with changed passwords?
Capcom has identified and reset those passwords. If your password was changed without your action, check your email for a reset notification.
Has any group claimed the attack?
No. No ransomware group or threat actor has publicly claimed responsibility as of October 25, 2026.
Was Capcom breached before?
Yes. In November 2020, the Ragnar Locker ransomware group attacked Capcom and claimed to have stolen 1TB of data, with up to 390,000 people potentially affected.
