Capcom Confirms CAPCOM ID Breach Hitting 11.77 Million Accounts, With a Phishing Warning for Players

By CriticalPixel · 2026-10-22

Capcom just told the world that somebody got into CAPCOM ID, the account service you need to play certain Capcom games online, and walked away with 11,774,247 email address records. IGN flagged the disclosure on the morning of October 22, and the company's own notice backs up every headline number. The good news is short: no credit card data was involved, and the games themselves still work. The bad news is long, because an email list that size, paired with login details, is the kind of list scammers dream about before a big holiday release season. If you ever made a Capcom account for Street Fighter 6, Monster Hunter or anything else, this one is worth ten minutes of your attention today.

Official Steam screenshot from Street Fighter 6, one of the Capcom games that uses CAPCOM ID for online services

What Capcom Says Leaked

According to Capcom's own notice, the 11,774,247 records worldwide cover email addresses plus what the company calls system-specific identifier information. That means the date and time each account was created, the date and time of the last login, the total number of logins, and the client IP address used during that last login. A much smaller slice, 43 records, also had a date of birth, gender, country or region, and nickname exposed. Capcom also confirmed that passwords were changed without authorization on 196 accounts, and it says those have already been reset. On the question everyone asks first, the company says it has not confirmed any compromise of the passwords customers originally set, and credit card information was not among the affected data. Automaton West notes that CAPCOM ID is the account used for online titles like Street Fighter 6, which is why this reaches well beyond a forgotten forum login.

Read the 196 number carefully, because it is the detail that matters most. Someone who can only read a table of emails is a problem. Someone who can change passwords on live accounts is a bigger one, since it means the attacker had a way to act on accounts, not just look at them. Capcom says it has identified and addressed the attack method, but none of the coverage I opened says what that method was. Until the company explains how the door was opened, players are being asked to trust a fix they cannot see. The notice also says the company is still investigating the scope of the impact, so treat every figure here as a count as of October 22, not a final tally.

The Timeline From October 19 to the Police Report

Capcom says it detected suspicious activity on October 19, started blocking the access right away, and confirmed the same day that unauthorized access had happened. On October 20 it set up an internal incident response headquarters, confirmed that customer information registered with CAPCOM ID had been accessed, and reported the matter to the Information Technology Security Oversight Committee, its external advisory body. On October 21 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. The public notice landed on October 22, three days after the first sign of trouble. Notebookcheck's write-up lines up with the same sequence and the same counts. Three days from detection to a public statement with specific numbers is not a bad pace for a breach this size, though it still means 11.7 million people learned about it after their data was already gone.

What Players Should Actually Do

Capcom says affected customers will be contacted directly and that the email addresses registered with CAPCOM ID can keep being used without interruption. The real risk is phishing. The company warns that the leaked information could be used to send fraudulent emails or messages impersonating Capcom or related parties, and it tells people not to open links or attachments in anything suspicious. That advice is correct, and the login IP data makes it more urgent than usual. An email address plus a rough idea of where you last logged in from is enough to build a convincing lure, something like a security alert about a sign-in from your city. My own advice, not Capcom's: treat any Capcom email about account problems, password resets or free giveaways as hostile, go to the official site by typing it yourself, and change your password if you reuse it anywhere else. Capcom has not confirmed that customer-set passwords were compromised, but password reuse is how small leaks become big ones.

Second official Steam screenshot from Street Fighter 6 showing a Capcom online fighting game

Why Another Game Account Is Another Liability

Here is the part that bugs me. Capcom's notice describes CAPCOM ID as a unified account that is needed to play certain Capcom games online. On PC and console, players already have a Steam, PlayStation, Xbox or Nintendo account holding their identity. Every publisher that bolts a proprietary login on top of that is building one more database for somebody to raid, and players pay the price when it gets raided. Nobody got a better fighting game because they had to hand Capcom an email address. The reaction I saw on X so far is early and thin, mostly split between phishing worries and people asking why they ever needed a Capcom account in the first place, so I will not pretend there is a settled community verdict yet.

The CriticalPixel Take

Credit where it is due: Capcom published exact numbers, a dated timeline, a police report and a phishing warning inside three days, which is more than a lot of publishers manage. The company also kept CAPCOM ID services running and says no game access was affected. What I want next is a plain explanation of how the attacker got in, why 196 accounts could have their passwords changed, and what Capcom is changing so the next account database is harder to crack. Until that arrives, the sane move is to assume your Capcom email is now on a list and act like it. If you play Capcom online, check your inbox with suspicion this week, and do not click anything that looks like it came from them.