Capcom confirms CAPCOM ID breach: 11.77 million email addresses and account metadata exposed, 196 accounts had passwords changed
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 24/10/2026 00:01; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ infosecurity-magazine.com ↗ securityweek.com ↗ bleepingcomputer.com ↗
Capcom disclosed on October 22, 2026 that an unauthorized third party breached CAPCOM ID, its unified account system for web services and online games, exposing 11,774,247 records of email addresses and account metadata (securityweek.com, gbhackers.com, infosecurity-magazine.com). Suspicious activity was detected and unauthorized access confirmed on October 19, and the compromise of customer data was established the next day (bleepingcomputer.com). For 43 accounts, personal profile details were also exposed, and attackers changed the passwords of 196 accounts, which Capcom has reset. Capcom says credit card data was not exposed and that games and services using CAPCOM ID remain available. No threat actor has been named, no IOCs have been published and the initial access vector has not been disclosed. Capcom says it identified the intrusion method and put preventive measures in place, and the investigation is ongoing.
Detalhes técnicos
- Affected asset: CAPCOM ID authentication and account service.
- Data exposed for all affected records: email address, account creation date/time, last login date/time, number of logins and the client IP address of the last login (bleepingcomputer.com, securityweek.com, gbhackers.com). Infosecurity-magazine.com describes these as email addresses and system-specific identifier information.
- 43 accounts also lost date of birth, gender, nickname and country/region.
- Integrity impact: unauthorized password changes on 196 accounts, apparently to lock owners out (bleepingcomputer.com). Capcom reset them.
- Timeline per Capcom's notice: suspicious activity detected, access blocked and unauthorized access confirmed on October 19. On October 20 an internal incident response headquarters was set up and the external Information Technology Security Oversight Committee was notified. On October 21 emergency response measures were completed, the attack method was identified and addressed, and the incident was reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission (gbhackers.com, infosecurity-magazine.com, bleepingcomputer.com).
- The date of the initial intrusion is unclear (bleepingcomputer.com). No vulnerabilities, malware or attribution are named.
- Background: bleepingcomputer.com recalls the November 2020 Ragnar Locker ransomware attack (up to 390,000 people potentially affected) and the April 2021 disclosure that attackers entered through an old VPN device. No source links these events to the current incident.
Remediação
- Capcom reset the passwords of the 196 affected accounts, is notifying affected customers in stages and has set up region-specific support channels.
- Users should be wary of unsolicited emails or messages impersonating Capcom or related organizations, and should not click links or open attachments in them. The exposed emails and login metadata could support phishing. Registered email addresses remain usable (gbhackers.com).
- Capcom has committed to further investigation, stronger security controls and additional public updates.
Relatos divergentes
- Record count: bleepingcomputer.com rounds the figure to "more than 11.7 million", while securityweek.com, gbhackers.com and infosecurity-magazine.com give the exact figure of 11,774,247. The sources are consistent, and the exact figure is the more precise.
- Password exposure: securityweek.com says Capcom states that no user passwords were compromised. Bleepingcomputer.com says passwords of other members were not exposed. Gbhackers.com and infosecurity-magazine.com are more cautious, saying Capcom has not confirmed or found a compromise of customers' original passwords. The wording of Capcom's notice is the authoritative basis, and the investigation is ongoing.
- Reporting date to authorities: bleepingcomputer.com says October 21 for the police and the Personal Information Protection Commission, which matches gbhackers.com and infosecurity-magazine.com. Only the latter two name the Osaka Prefectural Police. Bleepingcomputer.com also dates the confirmation of data compromise to October 20, whereas the other sources focus on the October 19 detection and confirmation of access.
Linha do tempo
-
Capcom confirms breach of 11.7 million CAPCOM ID records, with 196 unauthorized password changes
ler a análise desta fonte ocultar
Capcom disclosed on October 22, 2026 that an unauthorized third party accessed 11,774,247 CAPCOM ID records, the unified account system for its web services and online games. The exposed data includes email addresses and system identifiers. A small subset also had profile details exposed, and 196 accounts had passwords changed without authorization. Capcom says it contained the intrusion and that CAPCOM ID services and gameplay were not disrupted. The notice does not state the initial access method, any vulnerabilities or malware involved, or who the attackers were.
Technical Details
- Exposed fields: email addresses, account creation timestamps, last login times, login counts and the client IP address of the most recent login.
- 43 records also exposed dates of birth, gender, country or region, and nicknames.
- 196 accounts had unauthorized password changes. Capcom reset those passwords but has not confirmed that customers' original passwords were compromised. No credit card data was exposed.
- Timeline: suspicious activity detected and intrusion confirmed on October 19; internal incident response team formed and the Information Technology Security Oversight Committee notified on October 20; reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21.
- Capcom warns the data could be used for phishing or fraudulent messages impersonating the company or related organizations.
Remediation
- Capcom reset the passwords of the 196 affected accounts, contacts affected customers individually and has set up regional support channels.
- Users should avoid opening attachments or following links in suspicious messages. Registered email addresses remain usable.
- Capcom committed to further investigation, stronger security controls and additional public updates.
-
Capcom confirms CAPCOM ID breach exposing 11.77 million email and account metadata records
ler a análise desta fonte ocultar
Capcom disclosed on October 22, 2026 that a third party gained unauthorized access to customer data tied to CAPCOM ID, its unified account system for online play and web services. The company estimates that 11,774,247 records of email addresses and system-specific identifier information were compromised, along with 43 records containing date of birth, gender, country/region and nickname. Capcom also observed unauthorized password changes on 196 accounts, which have since been reset. Capcom reports no confirmed compromise of customer-set login passwords and says credit card data was unaffected. Games and services using CAPCOM ID remain available.
Technical Details
- Capcom detected suspicious activity in the CAPCOM ID system on October 19, 2026, blocked the access and confirmed the unauthorized access later that day.
- The exposed identifier data includes account creation date/time, last login date/time, number of logins and the client IP address of the last login.
- On October 20 Capcom set up an internal incident response headquarters and reported to its external Information Technology Security Oversight Committee.
- By October 21 the company said it had completed emergency response measures and identified and addressed the attack method. The article does not disclose the method. Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
- No threat actor has been named and no IOCs have been published.
Remediation
- Capcom reset the passwords of the 196 affected accounts.
- Customers are advised to be cautious with suspicious messages impersonating Capcom or related parties, and to avoid clicking links or opening attachments.
- The investigation into the full scope of the incident is ongoing.
-
Capcom discloses CAPCOM ID breach exposing 11.77 million email addresses; attackers changed passwords on 196 accounts
ler a análise desta fonte ocultar
Capcom disclosed a data breach affecting CAPCOM ID, its shared account service for online services and games, discovered on October 19. The attackers stole 11,774,247 email addresses along with account metadata: creation date, last login date, login count and the IP address of the last login. For 43 customers, dates of birth, gender, country/region and nicknames were also compromised. The attackers changed CAPCOM ID passwords on 196 accounts, although Capcom states that no user passwords were compromised. The company has reset the affected passwords, notified the relevant authorities and is still investigating. The article does not attribute the intrusion to any actor or describe the initial access vector.
Technical Details
- Compromised asset: CAPCOM ID authentication and account service.
- Data exposed: email addresses and account metadata (account creation date, last login date, number of logins, last login IP). A smaller subset also lost personal data (date of birth, gender, country/region, nickname).
- Integrity impact: unauthorized password changes on 196 accounts.
- Capcom says all services using CAPCOM ID remain available.
Remediation
- Capcom reset the passwords of the affected accounts, is contacting affected customers and has set up a dedicated contact point.
- Users should be wary of unsolicited emails impersonating Capcom or related entities that contain suspicious URLs or attachments.
-
Capcom confirms CAPCOM ID breach exposing 11.7 million customer email addresses and account metadata
ler a análise desta fonte ocultar
Capcom has confirmed that attackers breached CAPCOM ID, its shared membership and account system, exposing more than 11.7 million customer email addresses and associated account information. Capcom detected suspicious activity and confirmed unauthorized access on October 19. The following day it established that customer data had been compromised. It reported the incident to the police and to Japan's Personal Information Protection Commission on October 21. The date of the initial intrusion is unclear, and Capcom has not disclosed how the attackers got in, saying only that it identified the intrusion method and put preventive measures in place.
Technical Details
- Exposed data for all affected accounts: email address, account creation date, last login timestamp, number of logins and the IP address used at last login.
- For a subset of 43 accounts, date of birth, gender, nickname and country were also exposed.
- For another 196 accounts, the attackers changed the CAPCOM ID login passwords, apparently to lock the owners out. Capcom reset them.
- Capcom states that passwords for other members and credit card data were not exposed, and that its online services are unaffected.
- The article recalls earlier incidents: the November 2020 Ragnar Locker ransomware attack (up to 390,000 people potentially affected) and the April 2021 disclosure that attackers entered through an old VPN device.
Remediation
- Capcom is notifying affected customers in stages and has set up region-specific support channels.
- Users should be vigilant for unsolicited emails or messages requesting information or containing URLs or attachments, as the exposed emails and login metadata could support phishing.