Capcom disclosed a major security breach affecting 11,774,247 accounts worldwide on its CAPCOM ID membership service. The company first detected suspicious activity on October 19, 2026, exposing user email addresses, login timestamps, and IP addresses while confirming that customer-set passwords and payment details remained uncompromised.
Gamers relying on the free membership service for online features across major titles such as Street Fighter 6 found themselves caught in a digital sweep this week. Capcom announced on October 22 that unauthorized third-party access compromised millions of records globally.
For most players who treated the login as a routine credential created solely for matchmaking or bonus multiplayer content, the incident turned an ordinary inbox into a potential target for malicious actors.
The video game giant behind the Resident Evil, Monster Hunter, and Street Fighter franchises operates from its headquarters in Osaka, Japan, where CEO Kenzo Tsujimoto leads the organization founded on June 11, 1983. CAPCOM ID provides access to various online services and account features across Capcom’s gaming ecosystem, including titles such as Resident Evil Requiem and Onimusha: Way of the Sword. While Street Fighter 6 requires a Capcom ID for its online multiplayer services, other titles handle accounts differently; for instance, in Resident Evil Requiem, an ID is only necessary for linking platforms like Steam, Epic Games, and the Nintendo Switch to retain saves cross-platform, whereas Monster Hunter Wilds does not require one unless a player wants to link an ID for a bonus item.
What Data Was Exposed Across 11.7 Million Accounts
The scale of the breach covers approximately 11,774,247 accounts globally. According to IGN, the exposed records include account creation timestamps, last login dates, total login counts, and the client IP address associated with the final session, alongside system-specific identifiers logged during user visits.
A smaller subset of records suffered deeper exposure. Exactly 43 accounts had their dates of birth, gender, country or region, and nicknames leaked. Meanwhile, 196 accounts experienced unauthorized password changes.
Capcom Responds to the Security Breach
Capcom first noticed signs of unauthorized access on October 19, immediately blocking access to contain the intrusion and launching a thorough investigation. By October 20, the company established an internal response task force to assess the damage and identify the attack vectors.
🚨 Capcom reports data leak involving over 11.7M CAPCOM ID records.On October 19, Capcom detected unauthorized access to customer information. A third party accessed over 11.7 million records containing email addresses and related information, including IP addresses.📝… pic.twitter.com/GbrGPjeUOh
DualShockers reported that Capcom notified the police and Japan’s Personal Information Protection Commission by October 21. The firm also submitted reports to Osaka Prefectural Police.
Capcom Resets Passwords After Email Breach
While customer-created passwords and credit card details remained safe from the breach, the wide-scale leakage of email addresses created immediate security concerns. Capcom confirmed that passwords for the 196 accounts modified without authorization have already been reset.
If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.
Capcom, via Mashable
Players can continue using their registered email addresses to play online titles, but cybersecurity analysts warn that scammers will likely weaponize the leaked contact lists for deceptive messaging. The company stated that it has completed its emergency measures and identified the attack methods used, promising recurrence-prevention updates through official channels.