On October 23, 2026, it was reported that Capcom detected suspicious activity on October 19 and confirmed that same day unauthorized access to CAPCOM ID, the service players use to access the web services of the company and play some of its online titles. According to the notice of the company, the attackers obtained 11,774,247 records worldwide.
In most cases, the exposed data was email addresses along with the system information of each account, such as creation date, last login time, number of logins, and the IP address of the most recent login. Only in 43 records were the date of birth, gender, country or region, and the nickname of the account holder also exposed.
Capcom said it found no evidence that customer-set passwords were compromised, although the attackers changed the passwords of 196 accounts without authorization, which the company has already reset. No payment card information was included in the affected data, but the company warned that the stolen information could be used to send fraudulent messages impersonating Capcom, and asked users not to open links or attachments in suspicious messages.
Source: Help Net Security (https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/)
