Capcom and Square Enix Hit by Attacks, Capcom Ids Exposed

WHO:

Kotaku - Capcom and Square Enix services were targeted by unauthorized access from third parties.

Kotaku - An unnamed third party accessed some Final Fantasy XIV accounts.

Push Square - Capcom ID is Capcom’s free unified account system, providing access to online play in certain Capcom games and cross-platform play.

Push Square - Capcom said customers affected by its breach would be notified.

Kotaku - The Japanese government is considering ways to address a growing number of cybersecurity breaches affecting companies across sectors.

WHAT:

Kotaku - Square Enix reported unauthorized access to a number of Final Fantasy XIV accounts. It said the incident did not result from a direct breach of its own security or databases.

Kotaku - Capcom disclosed a direct breach of databases and services containing user information, affecting more than 11.7 million users; information exposed included system-identifying account information and email addresses.

Push Square - Capcom reported that 11,774,247 Capcom ID accounts were affected. Email addresses were the main information accessed, alongside account details such as creation and last-use times.

Kotaku - Capcom said information including date of birth, gender, and location was accessed in at least 43 cases; passwords were illegally changed on approximately 196 accounts.

Push Square - Capcom said it had not confirmed compromise of customer-set Capcom ID login passwords; passwords were changed without authorization on 196 accounts and reset. Credit-card information was not accessed.

Push Square - Capcom said customers could continue using their Capcom ID accounts, but affected information could potentially be used to send fraudulent communications impersonating Capcom or related parties.

WHERE:

Kotaku - The reported incidents involved services operated by Japanese companies Capcom and Square Enix.

WHEN:

Kotaku - The Capcom breach occurred on October 19th, and the vulnerability was fixed internally immediately.

Kotaku - Square Enix confirmed account access on October 19.

Kotaku - Cybersecurity breaches targeting Japanese companies had increased in recent weeks; breaches in 2026 had already surpassed the total for all of the previous year.

WHY:

Kotaku - Square Enix said the third party accessed accounts using credentials obtained from security breaches at other companies, rather than through a direct breach of Square Enix.

Kotaku - Many of the breaches targeting Japanese companies were described as powered by AI systems.

HOW:

Kotaku - Square Enix blocked access to accounts it believed might be compromised and warned it could require password resets and additional security measures across all accounts if breaches continued to increase.

Kotaku - Capcom investigated the cause of its breach and handed the information to police.

Push Square - Capcom said it continued investigating the scope of the impact.

(UPDATED October 24, 2026 13:06 UTC)

Capcom disclosed a direct breach affecting 11,774,247 Capcom ID accounts, while Square Enix reported unauthorized access to some Final Fantasy XIV accounts. Capcom said email addresses and account details, including account creation and last-use times, were accessed. In at least 43 cases, attackers also accessed details such as birth dates, gender, and location. Passwords were changed without permission on 196 accounts, then reset; Capcom said it had not confirmed that customer-set login passwords were compromised, and no credit-card information was accessed. The breach occurred on October 19, and Capcom said it fixed the vulnerability immediately, notified affected customers, and reported the matter to police. Square Enix said attackers used credentials stolen in breaches at other companies, not a breach of its own systems. It blocked accounts it considered at risk and warned further security steps may be needed.