Capcom has confirmed that a third party accessed 11,774,247 CAPCOM ID records worldwide, exposing email addresses and account metadata. Its October 23, 2026 follow-up also revealed that 19 users in Japan had their e-Capcom store account pages accessed after an attacker changed their CAPCOM ID login passwords without authorization.
The distinction matters for players of Capcom games, especially those concerned about phishing and account security. The publisher says no credit card data was included in the compromised information and that its games remain playable. The October 23 official update explains the newly documented store-account exposure.
What CAPCOM ID information was exposed?
In its original October 22 disclosure, Capcom described unauthorized access to customer email addresses and related system-specific records. The information included account creation dates, last-login dates, login counts and the IP addresses used for last logins.
The headline figure is 11,774,247 affected records, not a separately verified count of unique individuals. The company also confirmed several smaller, overlapping groups of affected accounts.
| Category | Confirmed impact |
|---|---|
| 11,774,247 records | Email addresses and account-specific usage metadata |
| 43 of those records | Birth dates, gender, country or region, and account nicknames |
| 196 of those accounts | Unauthorized changes to CAPCOM ID login passwords |
| 19 of those 196 accounts | Unauthorized access to Japanese e-Capcom store pages |
The groups overlap; they should not be added together. The 19 store-page cases are part of the group of 196 accounts whose passwords had been changed. The more sensitive personal information documented in those 19 cases was not said to be exposed across the entire affected record set.
What is new in Capcom's October 23 update?
The second notice describes the additional consequences of the unauthorized password changes. Capcom found that a third party had entered e-Capcom account pages for 19 Japanese customers, exposing information associated with those shopping accounts.
The affected store records included names, phonetic spellings of names, telephone numbers, postal codes, physical addresses, gender, dates of birth, purchase histories, customer inquiry histories and saved address-book information. The company says it will notify customers affected by the incident.
Capcom says it did not find information compromised through the unauthorized password changes for the other accounts in that 196-account group. It has completed the investigation of the impact stemming from those password changes, although security monitoring is continuing.
Were payment card details compromised?
No credit card information was included, according to Capcom's October 22 and October 23 notices. That is an explicit publisher statement, rather than a conclusion inferred from the number of affected accounts.
Did hackers steal CAPCOM ID passwords?
Capcom says it has not confirmed any compromise of the login passwords originally chosen by customers. That is different from the confirmed account changes: passwords for 196 CAPCOM ID accounts were changed without authorization, and the publisher says those passwords have since been reset.
For players, the practical lesson is to distinguish a reported password change from evidence of a leaked password database. These disclosures confirm the former for a limited subset of accounts, not the latter for the overall membership service.
CAPCOM ID continues to operate, and Capcom says its games are still accessible. That is reassuring for players who use online features, but exposure of email addresses and other account context still creates potential opportunities for convincing impersonation.
When did the CAPCOM ID incident happen?
The timeline in Capcom's first public disclosure is specific:
- October 19: Suspicious activity was detected. Capcom confirmed unauthorized access and began blocking it.
- October 20: An incident-response team was established, and investigators found customer information had been accessed.
- October 21: Capcom reported the incident to Osaka Prefectural Police and Japan's Personal Information Protection Commission.
- October 22: The company published its initial disclosure, identifying the scale of the records involved.
- October 23: The follow-up established that 19 e-Capcom store account pages had been accessed.
The publisher has not publicly identified the perpetrator or published a detailed exploit report. Claims assigning the incident to a specific hacking group or naming a particular attack method would go beyond what its notices establish.
What should Capcom players do now?
Capcom specifically warns that exposed information could support phishing messages impersonating the publisher or related companies. An email might look credible because it contains a familiar address or details connected with an account, even when the sender is not legitimate.
Rather than following links in unsolicited emails, visit the official CAPCOM ID portal directly. Review account access and security settings, and check whether an unfamiliar password reset or account change occurred.
Using a different password for each service is good general practice. If a CAPCOM ID password has been reused on another account, consider changing reused credentials. That is a precaution, not a claim that Capcom has reported every customer's password stolen.
How can an affected player contact Capcom?
Capcom directs users in the Americas and Europe, the Middle East and Africa to its official customer support form. The publisher says affected customers will be contacted individually.
That makes it especially important to verify any message claiming to come from Capcom. An unexpected request to open an attachment, enter a password or provide payment information should be treated cautiously.
What this means for Resident Evil and Monster Hunter fans
CAPCOM ID is a shared account service for Capcom web offerings and certain gaming features. The breach is therefore relevant to players, but it does not mean the games themselves were hacked. Capcom says gameplay remains unaffected.
The confirmed figures describe different layers of the incident: widespread exposure of account records, unauthorized password changes affecting 196 accounts, and a more sensitive set of store-profile exposures involving 19 people in Japan.
Bottom line: the publisher's latest update adds meaningful detail without overturning the initial picture. No payment-card data exposure has been reported and customers' original passwords have not been confirmed stolen, but the scale of the email and account-data breach warrants vigilance against fake Capcom communications.
Confirmed details first, useful context second. This is the quickest path to the source trail and the next pages worth opening.
Source date: October 23, 2026