Capcom: CAPCOM ID breach exposes 11.7 million records

Capcom, the Japanese video game publisher behind Resident Evil, Street Fighter and Monster Hunter, has confirmed unauthorised access to CAPCOM ID, the single account system players use to sign in to the company’s web services and to play some of its games online. According to the notice published on 22 October 2026, covered by BleepingComputer, SecurityWeek, Help Net Security, Infosecurity Magazine and Security Affairs, 11,774,247 records containing an email address and system data about the account were taken (worldwide total).

What happened

The timeline, as reconstructed by the sources from Capcom’s notice:

• 19 October: the company detects suspicious activity on CAPCOM ID, blocks the access and confirms the intrusion; it starts emergency measures and the analysis of the attack method;
• 20 October: it sets up an internal incident response unit, establishes that customer data has leaked and informs its external advisory committee on information security;
• 21 October: it completes the emergency measures, states that it has identified and addressed the attack method, and reports the incident to the Osaka Prefectural Police and to the Personal Information Protection Commission, Japan’s data protection authority.

The access method has not been disclosed, and it is not clear how long the attackers had been in the system. According to Help Net Security, no group had claimed the attack at the time of writing. Services using CAPCOM ID, games included, remain available.

Data involved

According to the notice, as of 22 October the exposed data includes:

• 11,774,247 records with an email address and system data about the account: date and time of creation, date and time of the last login, number of logins, IP address used for the last login;
• 43 records that also include date of birth, gender, country or region and nickname.

Capcom says it has found no evidence that passwords chosen by customers were compromised, and that payment card data is not affected. The attackers did, however, change the password of 196 accounts without authorisation; the company has since reset them. According to BleepingComputer the aim was to lock the owners out of their accounts; Capcom has not given an explanation.

SecurityWeek speaks of 11.77 million people, the other sources of records: the records correspond to accounts, not necessarily to distinct individuals.

Technical details

No CVE or malware has been disclosed. Two points matter to anyone running customer identity systems:

• the password changes: the attackers did not just read the database, they also acted on accounts. Based on what is known, this behaviour matches the MITRE ATT&CK technique Account Access Removal (T1531); it is not clear whether the changes were made through the application’s functions or directly in the database;
• the system data: creation date, number of logins and last-login IP show which accounts are active and from which country or network they connect. Combined with the email address, they make phishing more targeted and credible.

This is the main risk Capcom points to: fraudulent emails and messages impersonating the company or related parties. It asks users not to open links or attachments in suspicious messages. The exposed addresses can also be used in credential stuffing attempts against other services (technique T1110.004), where users have reused passwords already leaked in other breaches. No indicators of compromise have been published.

Previous incidents

This is not the first attack on Capcom. In November 2020 the company was hit by ransomware claimed by the Ragnar Locker group, which said it had stolen 1 TB of data. The sources give different estimates of how many people were potentially affected at the time: up to 390,000 according to BleepingComputer and Security Affairs, up to 350,000 according to Help Net Security. According to BleepingComputer, in April 2021 Capcom explained that the attackers had got in through an old VPN device. There is nothing linking that episode to the current incident.

Impact for European and Italian organisations

The figure is a worldwide total, and Capcom has opened dedicated support channels for Europe, the Middle East and Africa as well, alongside a toll-free number in Japan and a form for the Americas: European users are therefore among those affected. Many of them may have registered CAPCOM ID with their work email address, which becomes a target for phishing themed around games, gift cards or account problems.

For anyone managing customer accounts, the case confirms that login metadata is personal data too: under the GDPR the last-login IP address linked to an email identifies a person, and unauthorised access must be assessed for notification to the supervisory authority within 72 hours. For NIS2 entities (in Italy, Legislative Decree 138/2024) access control, multi-factor authentication and incident handling are among the required risk management measures.

What to do now

1. Warn your staff: emails in Capcom’s name are likely in the coming days; no links or attachments, and accounts should only be checked from the official website or game.
2. Tighten email filtering: check SPF, DKIM and DMARC on incoming messages and quarantine those from domains resembling Capcom’s.
3. Protect corporate accounts from credential stuffing: phishing-resistant multi-factor authentication, blocking of passwords already seen in known breaches, alerts on bursts of failed logins.
4. If you run a customer account system: require re-authentication to change the password or email, always notify the previous address, flag bulk changes and keep login IPs only as long as necessary.
5. Monitor access to the user database: large queries or exports, technical accounts connecting from new origins, out-of-hours activity.
6. Prepare user notification: texts, regional channels and timelines, ready before an incident.

How ARXDOME helps

ARX Expose flags company accounts involved in known breaches and lookalike domains registered by others, which are useful to anyone preparing phishing campaigns. ARX Sentry collects logs and events from computers, servers and firewalls and groups them into families such as failed logins and account changes. ARX Retain keeps the logs so that, in an investigation, you can reconstruct who had access and when.

Last updated: 24 October 2026