www.it-connect.fr
Capcom Breach: 11.7 Million CAPCOM ID Accounts Exposed
More than 11.7 million CAPCOM ID accounts exposed and 196 passwords changed by an attacker: these are the two key figures summarizing the cyberattack suffered by Capcom. Here’s what you need to know.
On October 22, 2026, Japanese publisher Capcom, known for hugely popular franchises such as Resident Evil and Street Fighter, published a statement announcing a cyberattack. An unauthorized third party was able to access customer information linked to CAPCOM ID. As a reminder, CAPCOM ID is the publisher’s unified account, used for its web services and for playing some of its games online.
Worldwide, this security incident is believed to affect 11,774,247 records. Capcom does not provide any breakdown by country, so it is impossible to know how many French players are affected. What is certain is that the events are very recent: Capcom detected suspicious activity on October 19 and the breach was confirmed the same day. The public is now being informed of the incident.
Despite this intrusion into its systems, CAPCOM ID services remain available and the games are not impacted. You can keep playing Resident Evil, but read the following before jumping back in.
What data was exposed?
Not everyone is affected in the same way by this security incident. In fact, each account may have been impacted in three different ways:
- Account data for 11,774,247 records: email address, account creation date and time, last login date and time, number of logins, and the IP address used during the last login.
- Profile information for 43 accounts: in addition to the items above, date of birth, gender, country or region, and nickname.
- Passwords changed for 196 accounts: the attacker changed the login password for these accounts. Capcom has already reset them.
Bank cards are not affected. Regarding passwords, the publisher is reassuring: "Capcom has not confirmed any compromise of the login passwords for CAPCOM ID accounts originally set by customers themselves.", the company says.
Passwords were not leaked, yet the attacker was able to change 196 of them. This suggests they may have had access to a mechanism allowing credentials to be modified, rather than just read-only data. For its part, Capcom says it has identified and addressed the attack method, without providing details.
As always with this type of incident, the risk for players is future malicious emails. Capcom itself warns that this information could be used to send fraudulent emails in its name. Given the list of affected data, one can imagine an email such as “unusual login detected” that includes your real IP address. So be cautious.
Finally, it is worth noting that this is not the first time Capcom has fallen victim to a hack. In November 2020, the publisher was hit by the Ragnar Locker ransomware gang, the same group that also targeted the LDLC group in late 2021. According to the findings of the investigation published by Capcom in April 2021, the attackers entered through an old backup VPN appliance at its U.S. subsidiary, and the data of 15,649 people was compromised.
