Capcom Confirms Breach Exposing 11.77 Million Accounts, No Cards Hit

WHO:

Mashable - Capcom, the game developer, and users of its Capcom ID accounts were affected.

AUTOMATON - Capcom reported unauthorized access by a third party to CAPCOM ID, its online membership service used for Street Fighter 6 and other services.

AUTOMATON - Capcom apologized for the incident.

WHAT:

Mashable - More than 11 million Capcom ID accounts were affected in a data breach.

AUTOMATON - Email address records for 11,774,247 accounts worldwide were affected, along with account creation and last-login dates and times, login counts, and the client IP address used at the last login.

AUTOMATON - The data breach included 43 instances involving users’ dates of birth, genders, countries or regions, and nicknames.

AUTOMATON - There were 196 instances of unauthorized password changes. Capcom said it had no evidence that users’ actual passwords were leaked; the passwords for the 196 affected accounts had been reset.

AUTOMATON - No credit card information was involved in the breach.

AUTOMATON - CAPCOM ID services were available, and the incident had not affected players’ ability to access Capcom games.

WHERE:

AUTOMATON - The affected account records were from users worldwide.

WHEN:

AUTOMATON - Capcom said it discovered signs of a potential breach on October 19, established an internal task force, and reported the incident to police on the 21st after confirming customer information had leaked and passwords had been changed.

WHY:

AUTOMATON - Capcom warned that leaked information could be misused, including in fraudulent emails or other communications impersonating Capcom or related parties.

HOW:

AUTOMATON - Capcom established an internal task force to block access and address the incident, and said it completed necessary emergency response measures.

AUTOMATON - Capcom advised users not to access URLs or open attachments in suspicious emails.

(UPDATED October 22, 2026 20:20 UTC)

Capcom says a data breach affected email records tied to 11,774,247 Capcom ID accounts worldwide. The exposed information also included account creation and last-login times, login counts, and the client IP address used for the most recent login. In 43 instances, records also included users’ birth dates, genders, countries or regions, and nicknames. Capcom reported 196 unauthorized password changes, but says it has no evidence that users’ actual passwords were leaked; passwords for those accounts have been reset. No credit card information was involved, and players can still access Capcom games while its ID services remain available. The company says it discovered signs of a possible breach, formed an internal task force, and reported the incident to police after confirming information had leaked. Capcom apologized and warns the data could be used for impersonation scams. It advises users to avoid suspicious links and attachments.