Capcom Data Leak: 11.77 Million Email Records Exposed in Cybersecurity Incident

Japanese gaming company Capcom has disclosed a cybersecurity incident involving unauthorised access to its CAPCOM ID membership service. The incident exposed more than 1.17 crore email accounts and account information, as well as the login passwords on 196 accounts that were changed without consent.

The company said it had taken emergency security measures, which are in keeping with some of its gaming franchises (Resident Evil, Street Fighter and Monster Hunter).

When did the Capcom Data Breach Happen?

Capcom discovered suspicious activity on 19 Oct 2026 and launched an investigation into unauthorised access. The company discovered the leak and reported on it on 22 Oct.

According to the figures, 11,774,247 records containing email addresses and related information were exposed globally. The company has not established in its public disclosure that these records represent the same number of unique individuals.

What information was exposed?

The compromised information included email addresses and technical details of CAPCOM ID accounts. These included account registration dates, last login times, login counts and IP addresses associated with previous logins.

More personal details—dates of birth, gender, country or region and nicknames—were revealed in 43 records.

Capcom said credit card data was not affected. It also reported that there was no clear evidence that users' original passwords had been leaked. However, password changes were found on 196 accounts and the passwords for those accounts were reset.

Will Resident Evil and Street Fighter players be affected?

CAPCOM ID is a unified account system for multiple Capcom games and online services. Therefore, a customer who registered with that service should be on top of the company's security updates.

Capcom has said services through CAPCOM ID are still available and that the incident has not disrupted gameplay. The full effect of unauthorised access is still being investigated.

The company has not identified the attackers or talked about details of how they penetrated the membership system.

What should Capcom users do?

Information about email addresses and account-related information can increase phishing and impersonation attempts. Criminals would use such information to send convincing messages pretending to represent Capcom or its support teams.

Users should take the following precautions:

• Avoid clicking suspicious links in emails claiming to be from Capcom.

• Do not open unexpected attachments or share verification codes.

• Check account activity and review any unexpected security notifications.

• Change passwords that have been reused across multiple websites.

• Enable two-factor authentication wherever it is available.

Players should also follow official CAPCOM ID announcements and contact customer support through verified channels if they suspect unauthorised activity.

Capcom Continues Its Investigation

Capcom has already taken action and begun notifying affected customers, the company says (link is in the documents).

For the time being, the most important issue is the information about the account (the email addresses) and the potential for fraud. Users should be on alert for suspicious communications and wait to see what the company does.