Unauthorised access to CAPCOM ID has been detected, affecting 11.7 million records
On 19 October 2026, Capcom detected suspicious activity on CAPCOM ID, blocked access and confirmed on the same day that a third party had gained unauthorised access. On 20 October, the investigation determined that some customer information had been leaked and that some passwords had been changed without authorisation. The company set up an internal response team and reported the incident to the Osaka Police and the Japanese data protection authority on 21 October.
The data breach affects 11.7 million records containing email addresses and technical account details, such as creation dates, last access dates, number of logins and IP addresses. In several cases, it also included date of birth, gender, country or region, and alias. A third party changed the passwords of several accounts – which have since been reset – and accessed personal and purchase data from some e-Capcom accounts. Capcom ruled out any card details being compromised and did not confirm that the original passwords had been exposed.
The latest official update, published on 23 October 2026, states that the investigation into the scope of the incident has been concluded and that Capcom continues to monitor CAPCOM ID and related services. The company completed emergency measures, identified and rectified the method of attack, and confirmed that services and games remained available. It has also begun to notify affected individuals on a case-by-case basis, set up support channels and announced measures to prevent similar incidents and strengthen its security.
