{"id":239567,"date":"2026-10-29T07:49:06","date_gmt":"2026-10-29T14:49:06","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=239567"},"modified":"2026-10-29T07:49:06","modified_gmt":"2026-10-29T14:49:06","slug":"capcom-id-data-breach","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/security-news\/capcom-id-data-breach\/","title":{"rendered":"CAPCOM ID Data Breach Hits 11.7M Accounts: What Players Should Do"},"content":{"rendered":"

Capcom, the Japanese publisher behind Street Fighter, Resident Evil, and Monster Hunter, confirmed on October 22, 2026, that an unauthorized third party accessed records tied to more than 11.7 million CAPCOM ID accounts<\/strong> worldwide. According to the company’s official notice<\/a>, the exposed data includes email addresses and account details such as creation dates, login counts, and the IP address used at last login. Capcom says credit card information was not affected, and it is warning players about fraudulent messages that impersonate the company.<\/p>\n

How the CAPCOM ID Breach Happened and What Was Exposed<\/strong><\/h2>\n

Unauthorized access to CAPCOM ID, a free player account for games such as Street Fighter 6, was detected on October 19, 2026, and blocked on the same day. The company reported the incident to police and Japan’s Personal Information Protection Commission on October 21.<\/p>\n

Most of the 11.7 million records held only an email address and basic account activity: creation date, last login, login count, and last-login IP address. Forty-three records also included a date of birth, gender, country or region, and nickname. The attacker also changed passwords on 196 accounts, which Capcom has since reset, and used 19 of them to view e-Capcom store profiles in Japan with names, addresses, phone numbers, birth dates, and purchase histories, according to an October 23 update<\/a>.<\/p>\n

Capcom says credit card information was not affected<\/strong> and it has not confirmed that customer-set passwords were compromised. Its investigation is complete, and it will notify affected customers.<\/p>\n

Why Phishing Is the Bigger Risk<\/strong><\/h3>\n

Capcom warns that the exposed data could be used in emails, texts, or calls impersonating the company. A message that quotes your real email address, account creation date, or last login can look convincing because those details are accurate. Scammers use that credibility to steer players to fake login pages or to request passwords, one-time codes, or payment details, which they can use to take over accounts or commit fraud.<\/p>\n

Gamers are a regular target. Every major game launch brings a noticeable increase in gaming-themed scams, including phishing pages posing as gaming platforms, according to McAfee’s August 2026 report on gaming scams<\/a>. McAfee Labs also recently reported on WeedHack, malware disguised as free Minecraft<\/a> clients and mods, that has infected more than 116,000 gamers<\/strong>.<\/p>\n

Warning Signs of CAPCOM ID Phishing<\/strong><\/h2>\n

Watch for messages that use the breach as a hook. Common red flags include:<\/p>\n\n\n\n\n\n\n\n\n\n
Red Flag<\/strong><\/td>\nWhy It Matters<\/strong><\/td>\n<\/tr>\n
An unexpected email or text about your CAPCOM ID, a password reset, or account suspension<\/td>\nThe breach gives scammers a believable reason to contact you.<\/td>\n<\/tr>\n
Your real account details used as \u201cproof\u201d<\/td>\nCreation dates, login counts, and IP addresses were exposed, so knowing them does not prove a message is from Capcom.<\/td>\n<\/tr>\n
A link or attachment urging you to \u201cverify\u201d or \u201csecure\u201d your account, especially from a look-alike domain<\/td>\nCapcom advises customers not to open links or attachments in suspicious messages.<\/td>\n<\/tr>\n
A request for your password, a one-time code, or payment card details<\/td>\nAttackers use these to take over accounts or commit fraud.<\/td>\n<\/tr>\n
Offers of free in-game currency, DLC, or compensation for the breach<\/td>\nFreebies tied to a breach are a common lure to fake login pages.<\/td>\n<\/tr>\n
An unsolicited call claiming to be Capcom support<\/td>\nCalls are harder to verify, and some phone numbers were exposed.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How to Protect Your CAPCOM ID and Gaming Accounts<\/strong><\/h2>\n

Treat any breach-related message as suspicious until you verify it yourself, then lock down the accounts attackers would target first:<\/p>\n

    \n
  1. Verify through Capcom directly.<\/strong> Don’t use links in messages. Type the CAPCOM ID site address into your browser, and use only the support contacts Capcom lists in its notice, such as the Capcom customer support site<\/a>. If you can’t confirm a request there, don’t act on it.<\/li>\n
  2. Change your CAPCOM ID password and any reused passwords.<\/strong> Capcom has not confirmed that customer-set passwords were exposed, but a new, unique password limits the damage if account details are misused. A password manager<\/a> makes maintaining many unique passwords practical.<\/li>\n
  3. Secure your email and turn on multi-factor authentication.<\/strong> Your email controls password resets, so protect it first. Then add multi-factor authentication to your PlayStation, Xbox, Nintendo, and Steam accounts so a stolen password alone isn’t enough to sign in.<\/li>\n<\/ol>\n

    What to Do If You’ve Already Been Targeted<\/strong><\/h2>\n

    If you clicked a link, entered your login, or shared information with someone posing as Capcom, act now to limit the damage:<\/p>\n