Capcom ID Breach Exposes 11.77 Million Email Addresses

If you have ever created a CAPCOM ID to play Street Fighter 6 online or to use Capcom's web services, your address may be in this set. Capcom put the count at 11,774,247 records worldwide in a notice dated October 22, 2026, and says it will contact affected customers in stages.

The company stresses what was not taken: no credit card data, and no confirmed leak of passwords that customers set themselves. That framing undersells the problem. On CAPCOM ID, your email address is your username, and the leaked metadata is detailed enough to make a fake Capcom email look uncomfortably real.

Key Takeaways

• Capcom confirmed that 11,774,247 CAPCOM ID records were exposed, each containing an email address plus account creation time, last login time, login count and the client IP address used at last login.
• Capcom says 43 of those records also exposed date of birth, gender, country or region, and nickname, and that 196 accounts had their login passwords changed without authorization before it reset them.
• October 19, 2026 is when Capcom detected and confirmed the intrusion, and on October 21 it reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
• Capcom has not named the attacker or disclosed how they got in, and it says credit card information was not affected.
• Capcom's own advisory warns that the data could be used for fraudulent emails impersonating Capcom, which makes phishing the most immediate risk for the people affected.

What Did Capcom Confirm?

Capcom confirmed that a third party accessed customer data tied to CAPCOM ID, the unified account it describes as "needed to play certain Capcom games online." The English press release is a translation; Capcom says the Japanese original prevails if the two differ. Both list three tiers of exposure:

• 11,774,247 records (worldwide total): email address plus system identifiers, which Capcom defines as the date and time of account creation, the date and time of last login, the number of logins, and the client IP address used during the last login.
• 43 records: date of birth, gender, country or region, and nickname, on top of the above.
• 196 accounts: login passwords changed without authorization. Capcom says these passwords "have already been reset."

On passwords, the wording is careful. Capcom "has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves." That is not the same as saying passwords were stored safely, and the notice does not mention hashing at all. Nor does it explain how an outsider changed 196 passwords without knowing the originals. It gives no regional breakdown.

How Did the Breach Unfold?

Capcom caught the intrusion itself and went public three days later:

• October 19, 2026: Capcom detected suspicious activity, began blocking the access, and confirmed the same day that unauthorized access had occurred.
• October 20: Capcom set up an incident response headquarters, confirmed the data exposure and password changes, and briefed its external security oversight committee.
• October 21: reports went to the Osaka Prefectural Police and the Personal Information Protection Commission.
• October 22: public disclosure.

Capcom says it has "identified and addressed the attack method," but not what that method was. BleepingComputer reported that the timing of the breach "remains unclear" and described the 196 password changes as "an attempt to lock the owners out." No group has claimed the attack, and neither Capcom nor BleepingComputer attributes it to one.

Why Is Login Metadata Worse Than a Plain Email List?

A bare email list tells a scammer that you exist. This one tells them how you behave. Creation date shows how long you have been a customer. Login count separates a daily Street Fighter player from someone who signed up once and never came back. The last login timestamp and IP address place your most recent session in time and, through IP geolocation, roughly on a map.

Follow that through to the inbox. A phishing email that says "we detected a login to your CAPCOM ID on [your real last login date] from a new location" no longer has to guess. It can quote a date you half remember. The Gyazo breach worked the same way: metadata that looks harmless on its own becomes context for a convincing lure. Gyazo's 23.62 million records make it about twice the size of Capcom's leak, while Capcom's is roughly 8.7 times the 1.36 million accounts exposed at Sakura Internet in August.

Has Capcom Been Hacked Before?

Yes. In November 2020 a ransomware attack encrypted devices on Capcom's network, and the company found a message from a group calling itself Ragnar Locker. Capcom's April 2021 investigation update traced the entry point to "an older backup VPN (Virtual Private Network) device" at its North American subsidiary and put the number of people whose data was verified as compromised at 15,649.

The 2026 incident is about 752 times larger by verified record count, and it hit something different. The 2020 attack reached internal corporate networks, and Capcom said then that the systems used to play or buy its games online were outside the scope of the incident. This time the target was the consumer account system itself, the one players log into. Six years on, the attack surface has moved from a forgotten VPN box to the front door.

Why Email Users Should Care

Your email address is your CAPCOM ID. Capcom's CAPCOM ID support page says so plainly: "Your ID is the email address used to register your account." So for every affected account the attacker now holds half of the login. The other half is the password, and if you reused your Capcom password on Gmail or anywhere else, credential stuffing tools will try that pairing for years. We saw how much raw material those tools have when 48 million Gmail logins surfaced in an infostealer database.

Phishing is the nearer threat, and Capcom admits as much: the data "could be misused to send fraudulent emails or other communications impersonating Capcom or related parties." Capcom will also be contacting the same people about the breach, so a genuine notice and a fake one can land in the same week. We covered this pattern after the Suno breach exposed 55 million email addresses, and again when the Brevo hack sent fake Trezor alerts: real breach details turn a generic lure into a believable one.

What Should CAPCOM ID Users Do Now?

Capcom's notice asks users only to avoid suspicious links and attachments. It does not tell anyone to change a password or turn on two factor authentication. Do both anyway:

1. Change your CAPCOM ID password by typing cid.capcom.com into your browser, never from an email link. If you cannot sign in, Capcom's support page says you can select "Forgot your password?" on the login page to reset it. Change the same password anywhere else you used it.
2. Turn on two factor authentication. CAPCOM ID supports it from the Account page. Per the support page, "Setting up two-factor authentication requires the use of a smartphone or tablet, and an authenticator app," and Capcom recommends Google Authenticator or Microsoft Authenticator.
3. Treat every Capcom email as suspect for the next few months. Ignore any message asking you to verify your account, confirm a login or claim compensation, and sign in directly instead. Contact Capcom only through the regional support channels listed in its notice.
4. Check your exposure. Have I Been Pwned had no Capcom entry when we queried its breach API on October 26, 2026. Subscribe to its notifications so you hear if the dataset surfaces.
5. Audit the Gmail account behind your CAPCOM ID. Gmail's last account activity panel (Details, bottom right of the inbox) lists recent access times and IP addresses. Then review third party app access at myaccount.google.com/linkedapps and remove anything you do not recognize.

What Capcom Still Has Not Said

Several questions remain open: how the attacker got in, how long they were inside before October 19, how they changed passwords on 196 accounts, and how CAPCOM ID passwords are stored. Capcom says it will post updates "through the company’s official website and other appropriate channels" if more facts need disclosure, so keep an eye on its investor relations notice. Until then, assume your email address and login habits are in someone else's hands.