Capcom Confirms 11.77 Million CAPCOM ID Records Exposed - and 196 Accounts Hijacked

Capcom has confirmed that a third party gained unauthorised access to CAPCOM ID, the unified account system behind its online games and web services, affecting 11,774,247 records worldwide. The figure matters because CAPCOM ID is the single login players use for online play in titles such as Street Fighter 6 and Monster Hunter, which means this breach reaches a global player base rather than the audience of any one game.

The headline from Capcom's disclosure is reassuring: passwords and credit card information were not exposed. But the company's own notice also confirms that the passwords of 196 accounts were changed without permission, and a follow-up report revealed that 19 customers of its Japanese online store had their personal details viewed. Those two facts sit awkwardly beside the "no passwords" line, and they are the most important part of the story.

The timeline is short. Capcom detected suspicious activity on 19 October 2026, published its initial notice on 22 October, and issued an update on 23 October saying its investigation was complete.

What Capcom Actually Confirmed

According to Capcom's investor relations notice, the unauthorised access affected exactly 11,774,247 records worldwide. Reports citing "11 million" or "11.7 million" are rounded shorthand for the same figure.

The exposed data consists of email addresses plus system-specific identifiers: the date and time an account was created, the date and time of the last login, the total login count, and the IP address of the most recent login.

For 43 of those records - a subset of the 11.77 million, not a separate group - date of birth, gender, country or region, and nickname were also exposed.

Capcom states plainly that passwords and credit card information were not among the leaked data. That claim is central to how the company has framed the incident, and it is accurate as far as it goes. What it does not capture is what happened to a small number of accounts after the access began.

The 196 Accounts That Weren't Just a Leak

Despite no password data being exposed, an attacker changed the passwords of 196 accounts without authorisation. That is an account takeover, not a data exposure, and the distinction matters.

Capcom's 23 October update closed the investigation and added a detail absent from the first notice: the attacker used those hijacked accounts to view the personal details of 19 e-Capcom customers, the company's Japanese online store. Those customers are being contacted individually.

Several outlets led with the record count and the email-address leak, while Capcom's own notice also disclosed the 196 unauthorised password changes. The takeover element changes the picture. Leaked data and compromised accounts are different problems, and both occurred here. A player whose email appeared in the dataset may face phishing attempts; a player among the 196 had their login taken from them outright.

Why Phishing Is the Real Risk for Players

The leaked fields are not especially sensitive on their own, but combined they are unusually useful to a fraudster. Security outlets such as Malwarebytes note that the leaked details could fuel convincing phishing messages; an email address paired with login timestamps, login counts and a recent-login IP gives an attacker material to reference real account activity.

A convincing fake might tell a player their account was accessed from a specific location on a specific date, quoting details that appear to come from Capcom's own records. That specificity is what makes such messages dangerous.

Capcom has warned users about phishing directly, and security outlets including IGN, Malwarebytes and Help Net Security have amplified the advice. The practical steps are straightforward:

• Treat unexpected Capcom-branded emails with suspicion, particularly any that quote your login history or ask you to verify your account through a link.
• Navigate to the official CAPCOM ID site yourself rather than following links in messages.
• Enable two-factor authentication on your account.

Capcom says emergency countermeasures are complete, CAPCOM ID remains usable, and there is no impact on gameplay in any game. Players do not need to abandon their accounts. They do have reason to secure them.

The reach of CAPCOM ID is precisely why this warrants attention. The same account underpins online play in titles such as Street Fighter 6 and Monster Hunter, so a compromised login can touch several games at once.

How This Compares to Capcom's 2020 Ransomware Attack

This is not Capcom's first security incident. In November 2020, the company was hit by a Ragnar Locker ransomware attack. Attackers claimed to have stolen 1 TB of data, and Capcom later said up to roughly 390,000 people could potentially be affected, with 16,415 confirmed. The entry point, an old VPN device, was disclosed in April 2021.

The contrast is worth drawing carefully. The 2020 incident was ransomware and extortion. The 2026 incident, as described by Capcom, is unauthorised access to an account system, with no ransomware or card-data element reported. The scale is also different: hundreds of thousands potentially affected then, 11.77 million records now.

Capcom has apologised and committed to monitoring and measures to prevent recurrence. For a company with this history, those commitments will be judged on what follows.

What to Do This Week

The gap between Capcom's reassuring headline and the concrete harm is where players should focus. No passwords leaked, yet 196 were changed by someone else. No card data exposed, yet 19 customers had their details viewed. Both statements are true, and only one of them will appear in most headlines.

This week, log in to your CAPCOM ID directly through the official site, review your account activity, turn on two-factor authentication if you have not already, and treat any unexpected Capcom email with suspicion until you have verified it independently. Capcom says its investigation is complete.

There is no cause for alarm about your games. There is every reason to spend ten minutes on your account. The account system tying those experiences together is still live, still usable, and now deserves a stronger password than it had last week.