Key takeaways

  • Capcom, the Japanese publisher of Resident Evil, Monster Hunter and Street Fighter, said on October 22, 2026 that attackers got into CAPCOM ID, the account players use for its web services and some online games.
  • Email addresses and login details for 11,774,247 accounts worldwide leaked: account creation time, last login time, number of logins and the IP address of the last login. For 43 accounts, birth dates, gender, country and nicknames leaked too.
  • The attackers changed the passwords of 196 accounts. Capcom has reset them, and says it has found no leak of the passwords players set themselves. No card data was involved.
  • Capcom spotted the intrusion on October 19, blocked it the same day, and disclosed it three days later. Games are unaffected, and CAPCOM ID can still be used.
  • It is one of the largest breaches of a Japanese company this year by number of accounts, and a global one: Capcom has set up support desks for Japan, the Americas, Europe, the Middle East and Africa, and Asia and Oceania.

What happened#

Date (2026) Event
Oct 19 Capcom finds traces of suspected unauthorized access to CAPCOM ID, blocks the access and confirms the intrusion the same day
Oct 20 Response headquarters set up. Capcom confirms customer data leaked and some passwords were changed. It reports to its external IT Security Oversight Committee
Oct 21 Reported to the Osaka Prefectural Police and the Personal Information Protection Commission
Oct 22 Public disclosure on its investor relations site, in Japanese and English

Capcom says it has identified and dealt with the attack method, but has not said what it was.

What leaked#

Accounts
Email address, account creation time, last login time, number of logins, IP address of last login 11,774,247
Of those, also birth date, gender, country or region, nickname 43
Of those, password changed by the attackers 196

Capcom has not confirmed any leak of passwords that players set themselves. It reset the 196 hijacked accounts and is still investigating. Credit card information was not affected.

Not Capcom's first incident#

In November 2020, ransomware from a group calling itself Ragnar Locker encrypted devices on Capcom's internal network. Capcom's final report, in April 2021, found the attackers had come in through an old backup VPN device at its North American subsidiary, and that data on 15,649 people, mostly employees, former employees and business partners, had been compromised. After that incident, Capcom set up the external IT Security Oversight Committee that it reported this incident to on October 20.

The two incidents are different. The 2020 attack hit internal systems and data on staff and partners. This one hit the customer account system used by players worldwide.

What we don't know yet#

Capcom has not said:

  • How the attackers got into CAPCOM ID, and what the attack method it has dealt with was
  • How the passwords of 196 accounts were changed, and what the attackers did with those accounts
  • Whether the data was copied out in bulk or reached in some other way
  • Where the affected players are, and whether regulators outside Japan have been notified
  • Whether CAPCOM ID will add or require stronger login protection

Our analysis#

Little data, and that helped#

The data Capcom held for most accounts was minimal: an email address and some login records. Only 43 accounts had any further personal details. That is the outcome good data minimization produces: a breach of 11.77 million accounts that exposes very little about each person. It is the kind of design we argued for in our analysis of data that companies did not need to keep, and a sharp contrast with this autumn's breaches that exposed names, addresses, ID documents and card data.

It does not make the leaked data harmless. A list of email addresses known to belong to active Capcom players, with the time and IP address of their last login, is good material for convincing phishing: a fake "suspicious login" or "account recovery" email that matches what the player recently did.

Changing a password needs more than reading a database#

The detail that matters most is the 196 accounts whose passwords were changed. Capcom says the passwords players set were not leaked, so the attackers did not log in with stolen passwords; they set new ones. In our view, that suggests the attackers could reach a function that writes to accounts, such as a password reset or an administrative tool, not only one that reads data. The mechanism is different from Iwai Cosmo Securities this week, where no passwords were changed and orders were placed through a vendor's system despite customer MFA, but the lesson is related: functions that can act on customer accounts without the customer logging in need protecting as tightly as the login itself. Capcom has not said how the changes were made, and we will update this when it does.

Quick to detect, quick to say#

Capcom found the intrusion, blocked it, and confirmed it on the same day, and disclosed it three days later with exact numbers, a timeline and support desks in four regions. After the 2020 attack, which entered through a forgotten VPN device, that is a marked improvement, and the kind of disclosure a global customer base needs.

What this means for readers#

  • If you have a CAPCOM ID, watch for a notice from Capcom, and treat any email about your account, login or password with suspicion. Go to Capcom's site directly rather than following links.
  • If you used the same password elsewhere, Capcom says passwords were not leaked, but changing reused passwords is still sensible.
  • Check your account for changes you did not make, such as a different email address or linked platform.
  • If you run account systems, review every function that can change a password, email address or linked account, including reset flows and admin tools, and alert on changes made without a matching user session.

Japanese terms at a glance#

Japanese Reading Meaning
不正アクセス fusei akusesu Unauthorized access
漏えい rōei Leak
システム固有の識別情報 shisutemu koyū no shikibetsu jōhō System-specific identifier information
パスワードの不正な変更 pasuwādo no fusei na henkō Unauthorized password change
セキュリティ監督委員会 sekyuriti kantoku iinkai Security Oversight Committee
対策本部 taisaku honbu Response headquarters