Capcom Officially Issues Apology After 11.7M+ CAPCOM ID Records Are Exposed in Security Breach

Capcom has officially issued a public apology after confirming unauthorized access to customer information associated with CAPCOM ID, affecting more than 11.7 million records worldwide. The Japanese gaming company disclosed the incident earlier today, October 22, 2026, following an investigation into suspicious activity detected earlier this week.

Although the company says players can continue accessing and playing its games, the scale of the incident does raise some legitimate concerns about how the exposed information could be used. Capcom has also confirmed unauthorized password changes on a small number of accounts, making its next steps particularly important.

Capcom Confirms 11.7 Million Records Exposed in Security Breach

According to Capcom’s official press release, the security breach exposed 11,774,247 records containing email addresses and system-specific information. This included account creation and last-login timestamps, login counts, and the IP addresses used during the most recent login.

The company also confirmed that 43 records contained additional personal details, including dates of birth, gender, country or region, and nicknames. Separately, 196 accounts had their login passwords changed without authorization.

Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves. However, the company has confirmed that passwords were changed without authorization on 196 accounts. The passwords associated with these accounts have already been reset.

Credit card information was also not included in the affected data, which is welcome news for customers concerned about payment security. However, that does not make the exposure insignificant. Email addresses combined with account activity and login-related information can give scammers useful material for crafting convincing messages.

Capcom’s timeline begins on October 19, when it detected suspicious activity, blocked access, and confirmed unauthorized entry. The company established an internal incident response headquarters on October 20 before reporting the matter to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21. Its investigation into the full impact is still underway.

Capcom Warns Players About Potential Phishing Attempts

Think twice before you click that link. | Credit: Capcom

The immediate concern is what someone could do with the exposed information. Capcom warns that attackers may use it to send fraudulent emails or messages impersonating the company or its related parties. A message containing familiar account details can look convincing, even when its real purpose is to steal login credentials or trick someone into opening a malicious attachment.

Capcom has advised users not to visit URLs included in suspicious messages or open their attachments. In other words, even if an email appears to reference a genuine CAPCOM ID account, make sure you double-check and avoid clicking unusual links, and verify account-related requests through official channels instead of trusting the message itself.

For now, CAPCOM ID services remain available, and the company says the incident has not affected players’ ability to access or play its games. Capcom plans to contact affected customers, continue investigating the breach, and strengthen its information security framework to help prevent a repeat. It has also established dedicated support channels for inquiries about the incident.

With more than 11.7 million records affected, the investigation will need to establish exactly how the unauthorized access occurred and whether the exposed information has been misused. Has a company data breach ever changed how you protect your gaming accounts, and what security measures do you expect Capcom to take next? Let us know in the comments below!