Capcom confirms CAPCOM ID breach exposing 11.77 million email and account metadata records
Capcom disclosed on October 22, 2026 that a third party gained unauthorized access to customer data tied to CAPCOM ID, its unified account system for online play and web services. The company estimates that 11,774,247 records of email addresses and system-specific identifier information were compromised, along with 43 records containing date of birth, gender, country/region and nickname. Capcom also observed unauthorized password changes on 196 accounts, which have since been reset. Capcom reports no confirmed compromise of customer-set login passwords and says credit card data was unaffected. Games and services using CAPCOM ID remain available.
Detalhes técnicos
- Capcom detected suspicious activity in the CAPCOM ID system on October 19, 2026, blocked the access and confirmed the unauthorized access later that day.
- The exposed identifier data includes account creation date/time, last login date/time, number of logins and the client IP address of the last login.
- On October 20 Capcom set up an internal incident response headquarters and reported to its external Information Technology Security Oversight Committee.
- By October 21 the company said it had completed emergency response measures and identified and addressed the attack method. The article does not disclose the method. Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
- No threat actor has been named and no IOCs have been published.
Remediação
- Capcom reset the passwords of the 196 affected accounts.
- Customers are advised to be cautious with suspicious messages impersonating Capcom or related parties, and to avoid clicking links or opening attachments.
- The investigation into the full scope of the incident is ongoing.
Linha do tempo
-
Capcom confirms CAPCOM ID breach exposing 11.77 million email and account metadata records
ler a análise desta fonte ocultar
Capcom disclosed on October 22, 2026 that a third party gained unauthorized access to customer data tied to CAPCOM ID, its unified account system for online play and web services. The company estimates that 11,774,247 records of email addresses and system-specific identifier information were compromised, along with 43 records containing date of birth, gender, country/region and nickname. Capcom also observed unauthorized password changes on 196 accounts, which have since been reset. Capcom reports no confirmed compromise of customer-set login passwords and says credit card data was unaffected. Games and services using CAPCOM ID remain available.
Technical Details
- Capcom detected suspicious activity in the CAPCOM ID system on October 19, 2026, blocked the access and confirmed the unauthorized access later that day.
- The exposed identifier data includes account creation date/time, last login date/time, number of logins and the client IP address of the last login.
- On October 20 Capcom set up an internal incident response headquarters and reported to its external Information Technology Security Oversight Committee.
- By October 21 the company said it had completed emergency response measures and identified and addressed the attack method. The article does not disclose the method. Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
- No threat actor has been named and no IOCs have been published.
Remediation
- Capcom reset the passwords of the 196 affected accounts.
- Customers are advised to be cautious with suspicious messages impersonating Capcom or related parties, and to avoid clicking links or opening attachments.
- The investigation into the full scope of the incident is ongoing.