11.7 Million CAPCOM ID Accounts Breached: Exposed IPs, Emails, and What Was Leaked in Capcom's Cyberattack
Japanese publisher Capcom has officially disclosed a massive cybersecurity incident targeting its unified CAPCOM ID online account service. In a public notice and apology issued on October 22, 2026, the Osaka-based company confirmed that unauthorized third-party access compromised a worldwide total of 11,774,247 account records. Anyone who registered a CAPCOM ID to access online matchmaking, cross-play, or community features in titles such as Street Fighter 6, Monster Hunter Wilds, Exoprimal, or the Resident Evil series should assume their email address and recent connection metadata were caught in the breach.
11,774,247 Exposed Profiles, 196 Tampered Passwords, and 43 Detailed Records
According to Capcom's official timeline, security teams first detected suspicious network activity on October 19, 2026, and immediately moved to block the unauthorized traffic. After establishing an internal incident response headquarters on October 20, the company formally reported the intrusion on October 21 to both the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
Forensic analysis of the compromised database divides the affected records into three distinct tiers of exposure:
- 11,774,247 global records: Across the entire affected user base, unauthorized actors accessed registered email addresses alongside system-specific account metrics. This includes the exact date and time of account creation, the date and time of the last login, total login counts, and the client IP address used during the most recent session.
- 196 accounts with unauthorized password changes: While Capcom stated there is no evidence that user-set passwords were leaked en masse, attackers managed to illicitly modify the login passwords on 196 specific accounts. Capcom has already invalidated and forcibly reset the credentials for all 196 affected profiles.
- 43 records with personal profile details: For a much smaller subset of 43 accounts, additional personal information was accessed, specifically dates of birth, gender, country or region of residence, and user nicknames.
No Credit Cards Compromised, But Core Online Franchises Rely on CAPCOM ID
On the financial front, Capcom emphasized that the CAPCOM ID platform does not process or store credit card numbers or payment details, meaning no banking information was exposed during the intrusion. Furthermore, game servers and online matchmaking across all supported titles remained operational without disruption.
Even so, the breach hits at a busy moment for the publisher's live-service and multiplatform catalog, right as players dive into new Monster Hunter Wilds events, competitive Street Fighter 6 tournaments, and the recent Patch 4.1 rollout for Dragon's Dogma 2: Dark Arisen. While Capcom previously suffered a high-profile ransomware attack in November 2020 that impacted roughly 390,000 internal records, this latest incident affects thirty times as many user email addresses worldwide.
How to Check If You Are Affected and Protect Your Account
Capcom announced that it is sending individual email notifications to affected account holders. However, delivering nearly 11.8 million notices takes time, and automated spam filters may intercept the message. Because Capcom has not launched a public web lookup tool to check individual addresses, the safest approach for any player with a CAPCOM ID is to assume their email address and last login IP were exposed.
Coming during a turbulent week for Japanese online infrastructure that also saw an 18-hour emergency server lockout in Final Fantasy XIV, players should take three immediate precautions:
- Watch out for targeted phishing emails: Because attackers now hold a verified list of 11.7 million gamer email addresses paired with login frequency and IP logs, convincing phishing campaigns impersonating Capcom support are a primary threat. Never click password-reset links or open attachments in unexpected emails; instead, navigate directly to the official
cid.capcom.comportal in your browser. - Rotate your CAPCOM ID password: Even though only 196 accounts suffered direct password tampering, updating your password immediately is strongly recommended, especially if you reuse credentials across other gaming platforms.
- Enable Two-Factor Authentication (2FA) on linked accounts: Make sure 2FA is active on your primary email inbox as well as your linked Steam, PlayStation Network, Xbox, and Nintendo accounts.
My Take: The Hidden Cost of Mandatory Publisher Accounts
This breach highlights exactly why players have grown so weary of mandatory third-party publisher accounts. Just to enable cross-play or claim a minor cosmetic reward on Steam, PS5, or Switch 2, modern games routinely force users to register yet another external profile. When a centralized database holding 11.7 million email addresses, login timestamps, and client IP addresses gets compromised, everyday players are the ones left dealing with years of targeted phishing attempts. Capcom deserves credit for disclosing the exact scope of the intrusion within 72 hours of detection, but the wider industry seriously needs to rethink forcing redundant account logins when console and Steam authentication already do the job.
SEO consultant for over 20 years and digital entrepreneur, Charles 'Grimtag' Ronchain is the founder of Pro-Gamer.gg, Retrocharting.com, and Gamescharting.com. A competitive gamer, streamer, and retro game collector, he has worked in the video game industry for over 15 years, notably as a consultant for leading game price comparison platforms. Passionate about real-time performance data and gaming technology, he analyzes competitive esports, gaming hardware benchmarks, and creator workflows on Pro-Gamer.gg with an authentic player perspective.
