Capcom, a leading Japanese video game company, has revealed a significant security breach affecting over 11 million records globally. This incident involves unauthorized access to its CAPCOM ID service, which is crucial for accessing various online gaming services.
Details of the Security Breach
Announced on October 22, 2026, Capcom disclosed that personal data such as email addresses and account activity details were exposed. The breach also resulted in unauthorized password changes for 196 accounts, prompting Capcom to reset these passwords to maintain user security. Despite this incident, Capcom’s gaming services remain operational.
CAPCOM ID is a unified account service utilized across various Capcom websites, essential for online gaming access. The breach has prompted Capcom to offer apologies and implement emergency response strategies, though a thorough investigation into the breach’s full extent is still ongoing.
Impact on User Data
The compromised records include registered email addresses, account creation and login timestamps, frequency of logins, and the IP addresses used during the last login. While this data reveals user activity, Capcom clarified that not every exposed record corresponds to a distinct individual.
A subset of 43 records also contained additional personal information, such as birth dates, gender, and geographic data, though this did not involve any credit card details. Capcom has not confirmed any breach of original passwords, despite the unauthorized changes made to some accounts.
Response and Future Measures
Detected on October 19, the suspicious activity led Capcom to promptly block access and investigate further. By October 20, the company had set up an internal incident response team to address the situation. The breach was reported to both the Osaka Prefectural Police and Japan’s Personal Information Protection Commission the following day.
While the method of attack has been identified, Capcom has not publicly shared specifics regarding the vulnerability or attacker. Customers are advised to be vigilant against potential phishing attempts using affected information. The company emphasizes avoiding suspicious emails or messages that may impersonate Capcom or related entities.
Capcom assures that affected customers will be notified and can still use their registered email addresses. Regional support channels have been strengthened, and planned security enhancements will be communicated as investigations progress. Capcom continues to emphasize the importance of updating defenses against new malware and integrating threat intelligence feeds.
