---
title: "CAPCOM ID account-data incident"
description: "Capcom disclosed exposed data for 11,774,247 CAPCOM ID records and password changes on 196 accounts."
incident_type: "Data incident"
status: "active"
last_modified: "2026-10-23"
canonical_url: "https://www.ally.security/incidents/capcom-id-account-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/capcom-id-account-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/capcom-id-account-data-incident-2026/stix.json"
---

# CAPCOM ID account-data incident

Unauthorized access exposed membership data; Capcom reset altered passwords and kept services available.

Last modified Oct 23, 2026 · 1 source

## Summary

- **Environment:** CAPCOM ID online membership service
- **Operational impact:** Services and game play remained available, according to Capcom
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Capcom](https://www.capcom.co.jp/) confirmed unauthorized access to CAPCOM ID on October 19, 2026. Its [disclosure](https://www.capcom.co.jp/ir/english/news/html/e261022.html) followed on October 22. [1](#source-1)

## Impact

Email addresses and system identifiers were exposed for 11,774,247 records worldwide, including creation and login timestamps, login counts and last-login IP addresses. This is a record count, not a unique-person count. A subset of 43 records also exposed birth dates, gender, country or region and nicknames. [1](#source-1)

Passwords were changed on 196 accounts and reset by Capcom. Exposure of customers’ original passwords was unconfirmed; credit-card information was excluded. [1](#source-1)

## Timeline

### October 19, 2026 — Access confirmed

Capcom blocked suspicious access and began investigating. [1](#source-1)

### October 20, 2026 — Data access confirmed

Investigators confirmed unauthorized data access and unauthorized password changes. [1](#source-1)

### October 21, 2026 — Authorities notified

Capcom reported to police and Japan’s privacy regulator. [1](#source-1)

### October 23, 2026 — Briefing updated

This briefing was last reviewed and updated on October 23, 2026.

## Threat Group & Attack Vector

Capcom said it identified and addressed the attack method, but did not publish the entry mechanism. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Capcom completed emergency measures, planned individual notifications and warned of impersonation emails. It said services and game play remained available. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/capcom-id-account-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Notice and Apology Regarding Customer Information Affected Through Unauthorized Access

official · Capcom · Oct 22, 2026

<https://www.capcom.co.jp/ir/english/news/html/e261022.html>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Data access and password changes confirmed: 2026-10-20
2. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Capcom reported exposure of email addresses and system identifiers for 11,774,247 CAPCOM ID records worldwide, including account creation and last-login times, login counts and last-login IP addresses.
3. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Police and privacy regulator notified
4. **Occurred At · 100% confidence · current**  
   Unauthorized access confirmed: 2026-10-19
5. **Affected Organization · 100% confidence · current**  
   CAPCOM ID account-data breach: Capcom Co., Ltd.
6. **Disclosed At · 100% confidence · current**  
   CAPCOM ID account-data breach: 2026-10-22
7. **Exposed Record Count · 100% confidence · current**  
   CAPCOM ID account-data breach: 11,774,247
8. **Discovered At · 100% confidence · current**  
   CAPCOM ID account-data breach: 2026-10-19
9. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Unauthorized access confirmed
10. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Capcom said credit-card information was excluded and CAPCOM ID services and game play remained available.
11. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Data access and password changes confirmed
12. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Capcom planned to notify affected customers and warned about impersonation emails.
13. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Capcom blocked the suspicious access, investigated the method and scope, and completed emergency measures.
14. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: A subset of 43 records also exposed dates of birth, gender, country or region and nicknames.
15. **Occurred At · 100% confidence · current**  
   Police and privacy regulator notified: 2026-10-21
16. **Resulted In · 100% confidence · current**  
   CAPCOM ID account-data breach: Attackers changed login passwords on 196 accounts; Capcom reset them and said exposure of customers’ own passwords had not been confirmed.

</details>