What happened
On October 22, 2026, Capcom said a third party got unauthorized access to CAPCOM ID, the account you use for Capcom web services and some online games. Capcom spotted the suspicious activity on October 19, blocked it the same day, and reported it to police and Japan's privacy regulator on October 21.
Capcom says services are still running and the incident does not affect playing your games. It says it will contact affected customers.
What data was exposed
Per Capcom's own notice: about 11,774,247 records with email addresses plus account info (when the account was created, last login date and time, number of logins, and the IP address from the last login).
For 43 of those records, date of birth, gender, country or region, and nickname too.
196 accounts had their passwords changed by the attacker. Capcom reset those. Of those 196, 19 Japanese e-Capcom store accounts had name, phone, address, birth date, purchase history and saved addresses viewed (October 23 update).
Capcom says it found no sign that passwords people set themselves were taken, and no credit card info was involved.
What to do now
- 01Expect phishing. A list of 11 million gamer emails is perfect for fake Capcom account alert or free game emails. Do not click login links in email. Go to the site yourself.
- 02Change your CAPCOM ID password if you have reused it anywhere, and change it on those other sites too. Capcom has not confirmed passwords leaked, but reuse is how one breach turns into five.
- 03Turn on two-step login for your gaming accounts (Steam, PlayStation, Xbox, Nintendo) and the email account tied to them.
- 04Check your CAPCOM ID login history if you can, and keep an eye out for the official notice from Capcom.
- 05Your IP address in a leak usually just means a rough location. Not great, not a reason to panic.
How to check if your email was exposed
Capcom says it will notify affected users directly. That is the only confirmed way to know you were in this one.
Have I Been Pwned is free and lists breaches once the data is verified and loaded.
OSINT Pro's email lookup checks an address against breach data and stealer logs, so you can see what else your email has turned up in. We are not claiming it includes the Capcom data unless that is later confirmed.