Capcom has confirmed one of the biggest gaming account breaches of the year. On Thursday, October 22, the publisher posted a notice and apology saying a third party got into data tied to CAPCOM ID, the free account you use for Capcom's web services and for online features in some of its games. More than 11.7 million records were affected worldwide. A day later, on October 23, Capcom followed up with a second report in Japanese that adds detail on the accounts where the attacker actually changed the password.
If you play Street Fighter, Monster Hunter, Resident Evil or anything else from Capcom online, there is a decent chance you have a CAPCOM ID, even if you only made it once to unlock a bonus or link a platform account. This guide walks through what Capcom has confirmed, what was not touched, and the handful of things worth doing today so the leak does not turn into a stolen account later.
Everything below comes from Capcom's own two notices and its official CAPCOM ID support pages. Where I am giving advice rather than quoting Capcom, I say so.
What Capcom Confirmed
Capcom split the affected data into three groups. The big number is the first one, and the scary details only apply to tiny subsets.
The headline is clear: for almost everyone, what leaked is an email address plus some login metadata. That sounds boring, but it is exactly the kind of data that makes phishing work, which is why the rest of this guide focuses on that risk.
What was not exposed
Capcom says credit card information was not included in either notice. It also says it has not confirmed any compromise of the passwords customers set themselves. The 196 password changes were the attacker setting new passwords on accounts, not a dump of everyone's existing passwords. Capcom has already reset those 196.
The company also stresses that CAPCOM ID still works, your email address can keep being used as your login, and the incident does not affect your ability to access or play any of its games.
Timeline of the Breach
Capcom laid out the timeline day by day:
- Monday, October 19: Capcom spotted suspicious activity on CAPCOM ID, started blocking the access the same day, and confirmed that unauthorized access had happened.
- Tuesday, October 20: An internal incident response headquarters was set up. Capcom confirmed customer data had been accessed and that a limited number of passwords had been changed. It reported the incident to its external security advisory committee.
- Wednesday, October 21: Capcom reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.
- Thursday, October 22: Public notice and apology posted, with the 11,774,247 figure and the customer advisory.
- Friday, October 23: Second report. Of the 196 hijacked accounts, 19 had their e-Capcom My Page accessed, exposing shipping and purchase details for customers in Japan. Capcom said its investigation into the scope of the impact is now complete, and no other information leaks from the password changes were found.
What Is CAPCOM ID, and Do You Have One?
CAPCOM ID is Capcom's unified account. Per the official CAPCOM ID support page, it is free, uses your email address as the login, and works across Capcom's games, game websites and other services. It is also where you link your PlayStation, Xbox, Steam, Epic or Nintendo account so your progress and rewards follow you.
Lots of players made one years ago and forgot about it. Common reasons you might have one:
- You linked a platform account to use Street Fighter 6's Buckler's Boot Camp site or other online features.
- You signed up to claim a pre-order, campaign or newsletter bonus for a Capcom release.
- You bought something from the e-Capcom store, which uses CAPCOM ID for login.
- You signed in on a Capcom game site to vote, check stats or join an event.
Why a "Just Emails" Leak Still Matters
My honest take: the numbers here are less dangerous than a password dump, but they are far from harmless.
Think about what an attacker can do with an email address plus the date you created your account, the date you last logged in, how many times you logged in and the IP address you used. That last item gives a rough location. Put together, it lets a scammer write an email that feels real:
- "Unusual login detected on your CAPCOM ID from a new location. Your last login was on [real date]. Click here to secure your account."
- "As an apology for the recent incident, claim your free Street Fighter 6 Fighting Pass or Monster Hunter bonus here."
- "Your CAPCOM ID will be suspended unless you verify your account within 24 hours."
The other risk is password reuse. Capcom says your original password was not confirmed leaked. But now that attackers have a fresh list of 11.7 million real gaming email addresses, they will try those emails with passwords from older breaches on other sites. If your CAPCOM ID password is the same one you use on Steam, PlayStation, Battle.net or your email, that is the real problem, not this breach on its own.
What to Do Right Now
None of this takes long. Here is the checklist I would follow today, in order of importance.
1. Turn on two-factor authentication for CAPCOM ID
CAPCOM ID supports two-factor authentication through an authenticator app. According to Capcom's support page, you set it up from your Account page, and you need a smartphone or tablet with an app such as Google Authenticator or Microsoft Authenticator installed first. Once it is on, nobody can log in with just your email and password.
One thing to remember: Capcom says that if you switch phones, you should turn off two-factor on the old device first and then set it up again on the new one. If you skip that step, you will not be able to log in from the new device.
2. Change your password if you reuse it
If your CAPCOM ID password is unique and strong, Capcom's statement suggests you do not strictly need to change it. If you reuse it anywhere, change it on CAPCOM ID and on every other account that shares it. A password manager makes this painless.
3. Lock down the email account behind it
Your email is the real key to your gaming life, because password resets for nearly every launcher go through it. Make sure your email has its own unique password and two-factor authentication turned on. If an attacker gets your inbox, CAPCOM ID two-factor will not save your Steam or PlayStation account.
4. Check your linked platform accounts
On your CAPCOM ID Account page, open Platform Account Information and confirm the PlayStation, Xbox, Steam, Epic or Nintendo accounts linked there are yours. Also check your nickname and other details for anything you did not change.
5. Treat every "Capcom" message as suspicious for a while
Do not click links in emails, texts or DMs that claim to be from Capcom about this incident. If you want to check your account, type the CAPCOM ID address into your browser yourself or use a bookmark. Capcom will contact affected customers, but it is safer to assume any message with a link could be fake and go to the official site on your own.
6. If you shop on e-Capcom, watch for targeted scams
The 19 accounts with exposed shipping and purchase data are all in Japan, and Capcom says it is contacting them individually. Even so, if you have bought from e-Capcom, be wary of fake delivery notices or "order problem" messages for a while.
Watch Out for These Scam Patterns
Breaches like this tend to bring the same handful of scams, and gaming communities are a favorite target. Some patterns worth recognizing:
- Fake compensation offers. "Capcom is giving affected players free DLC, in-game currency or a gift card." Real compensation would be announced on Capcom's official site and social channels, not through a random link.
- Fake support agents on Discord or social media. Scammers pose as Capcom staff and ask you to "verify" your account by sending a code or logging in through their link. Real support will not DM you first.
- Fake breach checker sites. "Enter your email and password to see if you were affected." Never type your password into anything other than the real login page.
- QR codes. Capcom's linking for Nintendo uses a QR code on screen, which makes fake QR code prompts more believable. Only scan codes your own game shows you.
- Phone calls. The October 23 report specifically warns about calls pretending to be Capcom. Hang up and contact support through the official channels below.
How to Contact Capcom About the Breach
Capcom set up dedicated support channels for this incident:
- North, Central and South America: Capcom USA customer support inquiry form.
- Europe, Middle East and Africa: the same Capcom support inquiry form, or email [email protected].
- Asia (excluding Japan) and Oceania: email [email protected].
- Japan: a dedicated toll-free CAPCOM ID incident line, 0120-801-271, open 10:00 AM to 8:00 PM JST. That works out to 8:00 PM to 6:00 AM CT the evening before, if you are calling from the US for someone in Japan.
The Bigger Picture
This is not the first time Capcom has dealt with a serious security incident. In November 2020, the company was hit by a ransomware attack from the Ragnar Locker group, which disrupted internal systems and leaked internal business documents along with personal data. Capcom later confirmed that personal information for roughly 15,000 people had been affected. That incident hit mostly employees, business partners and some customers in Japan. This one is different. It goes after the player account system directly and hits a global audience in the millions.
On the positive side, Capcom moved quickly by recent industry standards. It detected the activity on a Monday, reported it to police and regulators by Wednesday, published numbers on Thursday and finished its scope investigation by Friday. It also gave exact record counts instead of vague language, which helps players judge their own risk.
What is still missing is any detail on how the attacker got in, and any word on extra protections such as forcing two-factor for everyone or adding passkeys. Capcom says it will "further strengthen its information security framework" and will post updates on its official site if more facts come to light. If it adds new security features, I expect them to show up on the CAPCOM ID Account page first.
My bottom line: you do not need to panic, and you do not need to delete your account. Spend five minutes turning on two-factor, make sure the password is unique, and assume that anything "from Capcom" in your inbox over the next few months deserves a second look.
Frequently Asked Questions
Was my CAPCOM ID part of the breach?
Capcom says it will notify affected customers, but with 11,774,247 records involved worldwide, any CAPCOM ID that existed in October 2026 could be in the set. If you have an account, act as if your email address was exposed and follow the steps above. Search your inbox for emails from cid.capcom.com if you are not sure you have an account.
Were CAPCOM ID passwords leaked?
Capcom says it has not confirmed any compromise of the passwords customers set themselves. What it did find is that the attacker changed the password on 196 accounts. Capcom has reset those. If you reuse your CAPCOM ID password anywhere else, change it anyway to be safe.
Was credit card information stolen in the Capcom breach?
No. Capcom says credit card information was not included in the affected data in both the October 22 notice and the October 23 update.
Can I still play Capcom games after the breach?
Yes. Capcom says services that use CAPCOM ID remain available and the incident does not affect your ability to access or play any of its games. You can keep using the same email address as your login.
How do I turn on two-factor authentication for CAPCOM ID?
Log in to your CAPCOM ID Account page and open the two-factor authentication setting. You need a smartphone or tablet with an authenticator app such as Google Authenticator or Microsoft Authenticator. Scan the code shown on screen and enter the code from the app to finish. If you change phones later, turn two-factor off on the old device first, then set it up again on the new one.
When did the Capcom breach happen?
Capcom detected the suspicious activity and confirmed unauthorized access on October 19, 2026. It reported the incident to police and Japan's Personal Information Protection Commission on October 21, announced it publicly on October 22 and released a second report with the final scope on October 23.
What is e-Capcom and why does it matter here?
e-Capcom is Capcom's official online store, and it uses CAPCOM ID for login. Capcom's October 23 report says that 19 of the 196 hijacked accounts had their e-Capcom My Page accessed, exposing names, phone numbers, addresses and purchase history. All 19 are customers in Japan, and Capcom is contacting them individually.
Should I delete my CAPCOM ID?
You can, but it is usually not necessary, and deleting it does not undo the leak because the data has already been accessed. Capcom's FAQ also warns that deleted accounts cannot be restored, so you would lose linked progress and rewards. For most players, turning on two-factor and using a unique password is the better move.
How do I spot a fake Capcom email?
Be suspicious of any message about this incident that asks you to click a link, log in, enter a code or claim compensation. Real CAPCOM ID emails come from the cid.capcom.com domain, but sender names can be faked, so the safest habit is to never log in through a link. Type the official address yourself or use a bookmark.
Who do I contact about the CAPCOM ID breach?
Players in the Americas and in Europe, the Middle East and Africa can use the Capcom support inquiry form at capcom-support.com, and EMEA players can also email [email protected]. Players in Asia outside Japan and in Oceania can email [email protected]. In Japan, there is a dedicated toll-free line at 0120-801-271.
