Capcom Data Breach Exposes 11.7 Million Gamer Accounts

Capcom just told 11.77 million people that someone had been reading their account history for days before anyone at the company noticed. If you've ever linked a Resident Evil, Street Fighter, or Monster Hunter purchase to a CAPCOM ID, your email address and login timestamps are probably part of that pile.

What actually happened

Capcom first spotted suspicious activity on its CAPCOM ID system on October 19, 2026, and moved to block access while it investigated. By October 22-23, the company confirmed the real scale: 11,774,247 accounts worldwide affected. CAPCOM ID is the single login Capcom uses across its games and web services — it's what lets you sync save data, claim in-game bonuses, or register for competitive events, rather than a one-off website password.

What got out: account creation dates, usernames, email addresses, last-login dates and times, login counts, and the IP address used at the most recent login. For a tiny sliver of 43 accounts, date of birth, gender, country, and nickname were also exposed. Capcom says it hasn't confirmed that account passwords themselves were stolen, but it did find that passwords on 196 accounts were changed without the owner's authorization — those have since been reset. Credit card details, the company says, were never touched.

Why login metadata is still worth worrying about

It's tempting to read "no credit cards, no passwords confirmed" as a near-miss. It isn't quite. An email address paired with exactly when and from where you last logged in is enough raw material for a convincing phishing email — "we noticed a login from a new device, click here to secure your account" works a lot better when the attacker already knows your real login history. Capcom has flagged this directly, warning users to expect messages impersonating the company and to avoid clicking links or opening attachments in anything unexpected.

A breach that leaks no passwords can still hand attackers everything they need to write the one email that gets a password handed over voluntarily.

Capcom has reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission — that country's version of a national data protection regulator — and says it has already closed off the method used to get in, though it hasn't described what that method was. Its games and online services continue to run normally.

What this means if you're playing from India

Capcom's titles have a real following here — Street Fighter in particular has an active competitive scene, and Indian players have registered CAPCOM IDs over the years to take part in Capcom Pro Tour qualifiers alongside the usual save-sync and online-play reasons. None of that requires a credit card on file, which is exactly why this breach matters to more casual players too: you don't need to have spent money to have an exposed account.

It's also a useful comparison point. Capcom notified a Japanese regulator with established breach-reporting processes within days. India's own Digital Personal Data Protection (DPDP) Act requires companies handling Indian users' data to report significant breaches to the Data Protection Board of India and to the affected individuals "without delay" — but the Board and its enforcement machinery are still being built out, and most Indian users of foreign gaming platforms have little visibility into whether a breach like this even triggers a notification obligation to them specifically. A global company's breach response often reveals more about regulatory maturity than the breach itself does.

What to actually do about it

If you have a CAPCOM ID, a few concrete steps are worth more than general anxiety:

• Change your CAPCOM ID password now, even though Capcom hasn't confirmed passwords were taken — reusing an old one anywhere else is the bigger risk.
• Turn on two-factor authentication if Capcom's account settings offer it, so a leaked password alone isn't enough to get in.
• Treat any "verify your account" or "security alert" email claiming to be from Capcom with suspicion, and check the sender address rather than clicking through.
• If you reuse passwords across gaming accounts — common, and risky — this is a good prompt to move to a password manager instead of trying to remember unique ones yourself.

None of this is exotic advice, which is sort of the point. The accounts most at risk after a breach like this aren't the ones with exposed card numbers — they're the ones where someone reused "Resident2021" across five different logins. Breaches like Capcom's rarely end with the initial leak; they end a few weeks later, with a phishing email that looks just real enough.