Capcom Discloses Unauthorized Access to 11.77 Million CAPCOM ID Records

Capcom said in an October 22, 2026 press release that certain customer information associated with CAPCOM ID, the online membership account service it operates, was subject to unauthorized access by a third party, with 11,774,247 records affected worldwide. The Osaka-based company apologized to customers and other stakeholders and said it has reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.

CAPCOM ID is a unified account that registrants can use to access various Capcom web services and that is needed to play certain Capcom games online. Capcom said it has completed the necessary emergency response measures and that services using CAPCOM ID remain available. The incident does not affect players’ ability to access or play any of its games, the company said.

Affected Records and Account Status

The release breaks the affected information into three categories, with figures current as of October 22.

The principal category covers email address records and system-specific identifier information (the date and time of account creation, the date and time of last login, the number of logins, and the client IP address used during the last login), totaling 11,774,247 records as a worldwide total. Of that total, 43 records also contained date of birth, gender, country or region, and nickname.

Capcom also confirmed that passwords were changed without authorization on 196 accounts from within the same total. The company said the passwords associated with those accounts have already been reset, and that it has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves. It said it continues to investigate the scope of any impact resulting from the incident.

Credit card information was not included among the affected information, and Capcom said it will notify customers affected by the incident.

Incident Timeline

According to the release, Capcom detected suspicious activity indicating potential unauthorized access to CAPCOM ID on October 19, 2026 and immediately began blocking the access while investigating the cause and scope of the incident. The company confirmed that unauthorized access had occurred on the same day, implemented emergency measures, and proceeded with identifying and addressing the method of attack.

On October 20, 2026, Capcom established an internal incident response headquarters and continued information gathering and measures to prevent further impact. The investigation confirmed that certain customer information registered with CAPCOM ID had been subject to unauthorized access, and that passwords associated with a limited number of accounts had been changed without authorization. The company reported the matter the same day to the Information Technology Security Oversight Committee, its external advisory body.

On October 21, 2026, Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. The company said it continues to monitor the situation, investigate the incident, and assess the full scope of the impact.

Customer Advisory and Support Channels

Email addresses registered with CAPCOM ID may continue to be used without interruption, the company said. It warned that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties, and advised anyone receiving a suspicious email or message to exercise caution and to refrain from accessing any URLs contained in the message or opening any attached files.

The company has established dedicated customer-support channels for the incident. In Japan, a toll-free support line, 0120-801-271, operates from 10:00 a.m. to 8:00 p.m. JST. Customers in North, Central, and South America can submit an online inquiry form through the Capcom USA customer support page. Customers in Europe, the Middle East, and Africa can use the inquiry form or email [email protected], and customers in Asia outside Japan and in Oceania can contact [email protected].

Capcom previously detailed a separate data security incident in an April 13, 2021 release that presented the final results of an external investigation. According to that release, attackers gained unauthorized access to the company’s internal network in October 2020 through a cyberattack on an older backup VPN device maintained at North American subsidiary Capcom U.S.A., Inc. Devices at the company’s U.S. and Japanese offices were subsequently compromised, ransomware encrypted files on affected devices beginning late on November 1, 2020, and Capcom detected connectivity issues on November 2, 2020, finding a threatening message on the affected devices from a group calling itself Ragnar Locker.

The 2021 release put information verified to have been compromised in that incident at 15,649 people. It said none of the at-risk data contained credit card information, because online transactions were handled by a third-party service provider on a separate system that was not involved in the attack.

Following the 2020 incident, Capcom launched the Information Technology Security Oversight Committee in the latter half of January 2021 to receive continuous recommendations from external experts. The 2021 release describes four external committee members: two university professors who are cybersecurity experts, a lawyer specializing in cybersecurity and personal information protection law, and a certified public accountant who is an IT system audit specialist. This is the same external advisory body that, according to the new release, received the company’s report on the CAPCOM ID incident on October 20, 2026.

In the release, signed by President and COO Haruhiro Tsujimoto, Capcom said it has identified and addressed the attack method involved in the incident and takes the matter extremely seriously. The company said it will continue its detailed investigation and, based on the findings, will implement measures to prevent recurrence and further strengthen its information security framework. It said it will promptly provide updates through its official website and other appropriate channels should any additional facts requiring disclosure be identified.