Summary
- Environment: CAPCOM ID online membership service
- Operational impact: Services and game play remained available, according to Capcom
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 23, 2026; updated as evidence emerges.
What happened
Capcom confirmed unauthorized access to CAPCOM ID on October 19, 2026. Its disclosure followed on October 22. [1]
Impact
Email addresses and system identifiers were exposed for 11,774,247 records worldwide, including creation and login timestamps, login counts and last-login IP addresses. This is a record count, not a unique-person count. A subset of 43 records also exposed birth dates, gender, country or region and nicknames. [1]
Passwords were changed on 196 accounts and reset by Capcom. Exposure of customers’ original passwords was unconfirmed; credit-card information was excluded. [1]
Timeline
Access confirmed
Capcom blocked suspicious access and began investigating.
[1]Data access confirmed
Investigators confirmed unauthorized data access and unauthorized password changes.
[1]Authorities notified
Capcom reported to police and Japan’s privacy regulator.
[1]Briefing updated
This briefing was last reviewed and updated on October 23, 2026.
Threat Group & Attack Vector
Capcom said it identified and addressed the attack method, but did not publish the entry mechanism. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Capcom completed emergency measures, planned individual notifications and warned of impersonation emails. It said services and game play remained available. [1]