CAPCOM ID Data Breach Hits 11.7M Accounts: What Players Should Do

Capcom, the Japanese publisher behind Street Fighter, Resident Evil, and Monster Hunter, confirmed on October 22, 2026, that an unauthorized third party accessed records tied to more than 11.7 million CAPCOM ID accounts worldwide. According to the company’s official notice, the exposed data includes email addresses and account details such as creation dates, login counts, and the IP address used at last login. Capcom says credit card information was not affected, and it is warning players about fraudulent messages that impersonate the company.

No compromise. Promise

Your credit, finances, and info, all kept Safer Than Safe.

Learn more

How the CAPCOM ID Breach Happened and What Was Exposed

Unauthorized access to CAPCOM ID, a free player account for games such as Street Fighter 6, was detected on October 19, 2026, and blocked on the same day. The company reported the incident to police and Japan’s Personal Information Protection Commission on October 21.

Most of the 11.7 million records held only an email address and basic account activity: creation date, last login, login count, and last-login IP address. Forty-three records also included a date of birth, gender, country or region, and nickname. The attacker also changed passwords on 196 accounts, which Capcom has since reset, and used 19 of them to view e-Capcom store profiles in Japan with names, addresses, phone numbers, birth dates, and purchase histories, according to an October 23 update.

Capcom says credit card information was not affected and it has not confirmed that customer-set passwords were compromised. Its investigation is complete, and it will notify affected customers.

Why Phishing Is the Bigger Risk

Capcom warns that the exposed data could be used in emails, texts, or calls impersonating the company. A message that quotes your real email address, account creation date, or last login can look convincing because those details are accurate. Scammers use that credibility to steer players to fake login pages or to request passwords, one-time codes, or payment details, which they can use to take over accounts or commit fraud.

Gamers are a regular target. Every major game launch brings a noticeable increase in gaming-themed scams, including phishing pages posing as gaming platforms, according to McAfee’s August 2026 report on gaming scams. McAfee Labs also recently reported on WeedHack, malware disguised as free Minecraft clients and mods, that has infected more than 116,000 gamers.

Warning Signs of CAPCOM ID Phishing

Watch for messages that use the breach as a hook. Common red flags include:

How to Protect Your CAPCOM ID and Gaming Accounts

Treat any breach-related message as suspicious until you verify it yourself, then lock down the accounts attackers would target first:

1. Verify through Capcom directly. Don’t use links in messages. Type the CAPCOM ID site address into your browser, and use only the support contacts Capcom lists in its notice, such as the Capcom customer support site. If you can’t confirm a request there, don’t act on it.
2. Change your CAPCOM ID password and any reused passwords. Capcom has not confirmed that customer-set passwords were exposed, but a new, unique password limits the damage if account details are misused. A password manager makes maintaining many unique passwords practical.
3. Secure your email and turn on multi-factor authentication. Your email controls password resets, so protect it first. Then add multi-factor authentication to your PlayStation, Xbox, Nintendo, and Steam accounts so a stolen password alone isn’t enough to sign in.

What to Do If You’ve Already Been Targeted

If you clicked a link, entered your login, or shared information with someone posing as Capcom, act now to limit the damage:

• Stop responding to the sender and don’t send any money, codes, or card details.
• Reset your passwords now, starting with your email, then your CAPCOM ID and any account that shares that password. Check your email’s recovery phone number and forwarding rules for changes.
• Call your bank or card issuer right away if you entered payment details, and ask about stopping or reversing charges.
• Review your accounts for unfamiliar purchases, linked devices, or changed settings on your game platforms.
• Consider a credit freeze with Equifax, Experian, and TransUnion if you shared your name, address, date of birth, or other identity details.
• Visit identitytheft.gov for a personalized recovery plan if your personal information was misused.
• Keep records of suspicious messages, sender addresses, phone numbers, links, and any receipts.

How to Report CAPCOM ID Phishing

Reporting helps platforms and investigators shut down phishing campaigns. In the U.S.:

• FTC: Report phishing and fraud at ftc.gov.
• FBI Internet Crime Complaint Center: File a complaint at ic3.gov if you lost money or account access.
• Capcom: Report suspicious messages and account changes through the Capcom customer support site.
• Your email provider: Use the “report phishing” or “report spam” option so similar messages get filtered.
• Local police: File a report if you lost money or were threatened.

The CAPCOM ID breach exposed contact and account details, not credit card data, so the main threat now is phishing that looks like it comes from Capcom. Don’t click links in unexpected Capcom messages. Only sign in through the official site or your game, and use a unique password with multi-factor authentication on your email and gaming accounts.

FAQ

Was my credit card information exposed in the Capcom breach?

Capcom says credit card information was not included in the affected data. That applies to both the CAPCOM ID records and the 19 e-Capcom store accounts accessed in Japan.

Were CAPCOM ID passwords stolen?

Capcom says it has not confirmed that passwords customers set themselves were compromised. However, the attacker changed the passwords of 196 accounts, which Capcom has since reset. That said, it is still a good idea to update your password, use multi-factor authorization, and avoid using the same password for multiple accounts.

How do I know if my CAPCOM ID was affected?

Capcom says it will notify affected customers. Because 11.7 million records were involved, assume your email may be on the list if you have a CAPCOM ID, and watch for phishing.

Can I still play Street Fighter 6 and other Capcom games?

Yes. Capcom says access to games and CAPCOM ID–linked services was not affected, and registered email addresses can still be used.