A newly confirmed Capcom data breach has exposed information from 11,774,247 CAPCOM ID accounts worldwide. Email addresses and login records were accessed, but Capcom says credit card data was not affected and it has not confirmed that any player-set passwords were stolen.

If you use a CAPCOM ID for online play, cross-play or bonuses in Capcom games, the most important risk is phishing. Here is what leaked, what stayed safe and what you should do now.

Official Street Fighter 6 screenshot, a Capcom game that uses CAPCOM ID for online features
Street Fighter 6 is one of the Capcom games that ask players to link a CAPCOM ID. Image: Capcom

Capcom data breach: what was exposed

According to Capcom's official notice published on October 22, 2026, a third party gained access to customer information linked to CAPCOM ID, the free membership account the company uses across its web services and for online features in some of its games.

Advertisement View official NordVPN offer

The breach falls into three groups:

  • 11,774,247 records: email address plus system data, including account creation date and time, last login date and time, number of logins and the IP address used at the last login.
  • 43 of those records: also included date of birth, gender, country or region, and nickname.
  • 196 of those accounts: had their passwords changed without authorization. Capcom says it has already reset those passwords.

Capcom says credit card information was not part of the breach. It also says it has not confirmed that passwords set by customers were compromised.

Timeline: how Capcom found the attack

Capcom says it detected suspicious activity on October 19, 2026, blocked the access the same day and confirmed that an intrusion had happened. On October 20 it set up an internal incident response headquarters, confirmed that customer data had been accessed and found the unauthorized password changes.

On October 21 the company reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. The public disclosure followed on October 22.

The notice does not explain how the attacker got in. Capcom only says it has identified and dealt with the method, that its emergency measures are complete and that CAPCOM ID remains available, so you can still log in and play.

Official Street Fighter 6 screenshot of a fight, illustrating the CAPCOM ID data breach story
Capcom says CAPCOM ID remains available and players can keep logging in and playing. Image: Capcom

What is CAPCOM ID and which games use it

CAPCOM ID is a single account that ties together several Capcom services. Players link it to their PlayStation, Xbox, Nintendo or Steam account to use online features and claim in-game rewards. Street Fighter 6 is one of the best-known examples: Capcom has run campaigns that required players to link a CAPCOM ID to the platform account they use in the game.

That is why the number is so large. Anyone who created a CAPCOM ID to unlock bonuses, join an event or use Capcom's web services could be on the list, even if they rarely log in.

What Capcom players should do now

Capcom says affected customers will be notified, and it has already started contacting them. You do not need to stop using your email address, but you should be careful with any message that claims to come from Capcom or a related company.

  • Watch for phishing. Criminals can now pair your email with the fact that you play Capcom games. Do not open links or attachments in unexpected emails about rewards, account problems or refunds.
  • Change your CAPCOM ID password if you reused it anywhere else, and do not reuse it in the future. Capcom has not confirmed password theft, but a unique password removes the risk.
  • Check your linked platform accounts. Turn on two-step verification on PlayStation Network, Xbox, Nintendo Account and Steam, where your purchases and payment methods live.
  • Use official support channels only. Players in the Americas and in Europe, the Middle East and Africa can contact Capcom through its official support site. Capcom also lists a dedicated phone line in Japan and an email address for Asia and Oceania.
Official Street Fighter 6 screenshot, Capcom fighting game linked to CAPCOM ID rewards
Linked accounts are used for online play and in-game rewards in Capcom titles. Image: Capcom

Capcom's second major breach in six years

This is not the first time Capcom has had to deal with a security incident. In November 2020 a ransomware attack hit the company's internal network and exposed personal data belonging to customers, business partners and employees, as reported at the time by Video Games Chronicle and others.

The new incident is different in scale and type: it targets player accounts directly. It also lands at a busy time for the publisher, whose online games and events depend on CAPCOM ID for rewards and cross-platform features. If you play Capcom's fighting games, our Street Fighter 6 beginner's guide explains the basics, and our look at whether Monster Hunter Wilds is worth it covers another major Capcom online game.

What happens next

Capcom says its investigation into the full scope of the breach is ongoing and that it will strengthen its information security framework to prevent a repeat. Further updates will be posted on its official website if new facts emerge.

For now, the practical takeaway is simple: your game library and credit card details are not reported as affected, but your email address may be in the wrong hands. Treat any unexpected Capcom-branded message with suspicion until you have checked it through the official site.