Capcom Data Breach Hits 11.7M User Accounts
In short: Capcom has confirmed a breach affecting 11,774,247 Capcom ID accounts — the single sign-on service used across the studio's games (Street Fighter, Monster Hunter, Resident Evil, and others). Attackers obtained email addresses, account creation and last-login dates, login counts, and the IP address from the last session; passwords were changed without authorization on 196 accounts. No banking data was affected. If you've played a Capcom game, our guide on protecting an account from a hack walks through what to do.
What happened
On October 19, 2026, Capcom detected signs of unauthorized access to the Capcom ID infrastructure — the login service players use to sign into the studio's mobile and console titles. The company quickly blocked the suspicious activity, formed an internal investigation task force the next day, and on October 21 formally notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The investigation is ongoing, and the exact entry point hasn't been disclosed.
What data ended up with attackers
At risk are 11,774,247 records: email addresses, account creation and last-login dates, login counts, and the IP address used during the last session. A smaller set of 43 accounts also had their date of birth, gender, country or region, and in-game nickname exposed. According to the company, passwords that users set themselves were not stolen — but on 196 accounts, passwords were changed without the owner's permission. That's the typical signature of credential stuffing: attackers trying passwords leaked from other sites rather than breaking into Capcom ID itself. Credit card data was not part of the incident.
Why an email-and-IP leak is dangerous even without passwords
11.7 million real, active email addresses tied to a specific gaming service is a ready-made list for precision phishing: an email "from Capcom" asking to confirm an account, complete verification, or claim compensation looks credible precisely because the recipient really did play the studio's games and really did receive emails from it before. The account's creation date and login count let attackers pick a believable scenario for a given address — an "old" account gets a "suspicious activity" email, an active one gets an "updated terms of service" one.
The last-session IP address alone doesn't reveal an exact home address, but it ties the account to a specific internet provider and region — combined with other leaked data, that makes de-anonymization and password-guessing against other services using the same email easier. The same logic drives infostealer malware that steals entire browser password and cookie stores; see our breakdown in how infostealers steal passwords.
What to do if you've played Capcom games
- Change your Capcom ID password, and any other password that's identical — credential stuffing only works because people reuse the same combination.
- Turn on two-factor authentication wherever it's available: a leaked password without a second factor doesn't grant account access.
- Treat any email "from Capcom" urging you to click a link, confirm details, or enter a card number with suspicion — the company explicitly warned about this risk following the incident.
- Check the active sessions on your key accounts (email, gaming services, social media) and sign out of anything you don't recognize — our guide on checking active account sessions walks through how.
- If you log into gaming and other online services over public Wi-Fi or a network a stranger's ISP can see and log, a VPN hides your real IP address at connection time — see LiMP VPN's features for Android, Windows, and Chrome.
Sources
Frequently asked questions
Was my Capcom ID password stolen?
According to the company, no — passwords users set themselves were not stolen. But on 196 accounts, passwords were changed without the owner's permission, which looks like credential stuffing: attackers trying passwords leaked from other sites rather than breaking into Capcom ID directly.
Was credit card data affected in this breach?
No, according to Capcom, credit card data was not part of the incident. What leaked were email addresses, account creation and login dates, login counts, and the last-session IP address; for 43 accounts, also date of birth, gender, region, and nickname.
Will a VPN help against the consequences of this breach?
A VPN doesn't undo the breach and doesn't protect your Capcom ID account directly — that requires changing your password and enabling two-factor authentication. What a VPN does help with is separate: it hides your real IP address when you log into gaming and other online services over public or untrusted networks, reducing the risk of it being tied to future leaks.