Japanese video game publisher Capcom has disclosed a major security breach affecting its CAPCOM ID membership service, exposing information associated with more than 11.7 million accounts worldwide. The incident also allowed attackers to change passwords on nearly 200 accounts, although the company says customers’ original passwords and credit card information were not compromised.
The affected platform provides a shared account system for Capcom’s online services and certain games, including Street Fighter 6. According to the company’s October 22 announcement, unauthorized access resulted in the exposure of 11,774,247 email addresses alongside account-related information.
The compromised records included account creation dates, last login timestamps, login counts, and IP addresses used during the most recent login. A smaller group of 43 accounts had additional personal details exposed, including dates of birth, gender, country or region, and nicknames.
Investigators also discovered that attackers had changed the login passwords of 196 accounts without authorization. Capcom has since reset those passwords and emphasized that its investigation has found no evidence that passwords originally created by customers were stolen.
The company first detected suspicious activity involving CAPCOM ID on October 19, 2026. After confirming unauthorized access, it blocked the activity and began investigating how the intrusion occurred and which information had been affected.
An internal response team was established the following day, when investigators confirmed the exposure of customer information and identified the unauthorized password changes. On October 21, Capcom reported the incident to Japanese police and the country’s Personal Information Protection Commission.
Capcom says emergency security measures have been completed and that services using CAPCOM ID remain available. The company also stated that the incident has not disrupted gameplay across its titles.
Although payment information was not involved, the exposure of millions of email addresses presents potential phishing risks. Criminals could use the leaked contact details to send convincing messages impersonating Capcom, directing recipients to fraudulent websites or malicious attachments.
The publisher has begun notifying affected customers individually and established dedicated support channels for questions about the breach. It has also advised users to exercise caution when receiving unexpected emails claiming to originate from Capcom or related services.