Technology Miraj Islam October 24, 2026 0 Comments

Capcom data breach confirmed – around 11.7 million accounts believed to have been affected

Add us as a preferred source on Google

Subscribe to our newsletter

Capcom Reveals Breach Affecting 11.7 Million CAPCOM ID Users, Exposing Mostly Email Addresses
A small number of accounts also lost personal data, and the attackers reset the passwords of 196 accounts.
The company secured the platform, notified authorities and warned users about phishing attempts.

Japanese gaming giant Capcom has just confirmed that it suffered a data breach that exposed sensitive information of more than 11.7 million people. Almost all had their emails compromised, and a small subset also lost their birthdays and locations, in addition to changing their passwords.

Capcom is a very popular video game developer and publisher, behind mainstream names like resident Evil and street fighter. One of its services is called CAPCOM ID: it offers a free, unified account that allows users to access various online games and services.

CAPCOM ID currently has more than 10 million users and the company recently posted a new security advisory on its Japanese site, saying that a third party accessed the service, “resulting in the leak of certain customer information to external parties.”

Change passwords

“We deeply apologize for the great inconvenience and concern caused to our customers and all interested parties,” the machine-translated warning reads.

Capcom said the breach triggered its security protocols and the CAPCOM ID service has been secured. It remains available for use and has no impact on the gameplay of any of the games.

However, analysis of the breach determined that the threat actors obtained 11,774,247 user email addresses, as well as system-specific identifying information: account creation date and time, last login date and time, number of login counts, and client IP at last login.

For a handful of users (43 of them), the threat actors also obtained dates of birth, gender information, nicknames, and data about their country and region. The attackers managed to change the passwords of 196 people, in an attempt to lock legitimate users out of their accounts. The passwords themselves were not leaked and Capcom said it triggered the password reset process and the accounts were restored to their rightful owners.

“We will contact eligible customers individually in order. Please note that credit card information is not included in the scope of the breach,” the company concluded.

Capcom did not discuss the identity of the attackers or the nature of the breach. Therefore, we don’t know if the attackers stole an employee’s login credentials through phishing or broke in using a vulnerability like the php2shell flaw that everyone is scrambling to fix right now. We also don’t know if the attackers tried to make contact or tried to extort money from Capcom in exchange for deleting the data.

No threat actor has yet claimed responsibility for the dark web attack and has not shared samples or leaked the entire database. Capcom said it has notified police and other relevant authorities and the investigation continues.

Pointed again

Capcom has had cybersecurity incidents in the past. In November 2020, the company fell victim to the infamous Ragnar Locker ransomware group, which managed to make off with a terabyte of sensitive data. A few months later, the company said the attackers entered through an old VPN device and confirmed that the breach affected 390,000 people.

Capcom also manufactures and operates gaming machines and, as of March 2026, employed nearly 4,000 people worldwide. In fiscal 2025, its games sold 51.87 million units, and two titles, Resident Evil and Street Fighter, are making strong inroads into movie theaters around the world. For fiscal 2026, the company’s annual revenue reached $1.3 billion.

Simply having someone’s email address is not enough for a serious cyberattack, but it is a good start towards a highly personalized phishing email that can result in ransomware infections, data theft, or business email compromise (BEC). Capcom is now urging users to be vigilant and cautious with incoming email messages, especially those that contain references to the company.

Through beepcomputer