Capcom has confirmed that an intrusion into its CAPCOM ID membership system reached account records tied to more than 11.7 million customers, with email addresses among the data involved.
In the alert published on October 22, 2026, the company lists the other exposed fields as the date each account was created, the timestamp of its most recent login, the number of times it had been used to sign in, and the IP address recorded at that last login.
Two smaller groups were affected more deeply. For 43 accounts, birth dates, gender, nicknames and countries were also exposed. On 196 accounts, the intruders changed the CAPCOM ID login passwords in an attempt to lock the owners out, and Capcom said it reset them.
Passwords belonging to every other registered member were not exposed, according to the company, and payment card information was untouched. CAPCOM ID is the shared sign-in used across Capcom's web services and for playing some of its online games.
What Capcom has said about the timeline
The company has not established when the intrusion itself began. It says suspicious activity was detected and unauthorized access confirmed on October 19. An investigation started immediately, and by the following day it was clear that customer information had been compromised. The incident was reported to the police and to Japan's Personal Information Protection Commission on October 21.
Capcom says the investigation established how the intruders got in and that security measures have been put in place to prevent a repeat, but it has not shared details of the initial access. Its online services, it said, remain unaffected.
Affected customers will be notified in stages, and regional channels have been set up for support requests, according to the company. Capcom also urged customers to be wary of unsolicited communications — emails asking for additional information, and messages carrying URLs or attachments.
Capcom previously dealt with a November 2020 ransomware attack claimed by the Ragnar Locker gang, which said it had taken 1 TB of data; the company later warned that up to 390,000 people could be affected, and in April 2021 disclosed that the attackers had entered through an old VPN device.
