{
  "id": "capcom-id-breach",
  "url": "https://ohshit.app/incidents/capcom-id-breach/",
  "title": "CAPCOM ID breach exposes 11,774,247 email and account-metadata records",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-22",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Capcom",
    "breach",
    "accounts"
  ],
  "ecosystems": [
    "capcom"
  ],
  "summary": "Capcom confirms 11,774,247 exposed email/account-metadata records. Within that total, 43 records include additional profile data and 196 accounts had passwords changed without authorization.",
  "splash": "CAPCOM ID members worldwide; record count is not a verified count of unique people",
  "wipe": "Watch for phishing; review account access and use official support for unexpected changes",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Avoid links and attachments in unexpected Capcom messages"
    },
    {
      "title": "Review CAPCOM ID access and contact official support about changes"
    },
    {
      "title": "Follow affected-customer notifications through official channels"
    }
  ],
  "sources": [
    {
      "name": "Capcom disclosure (Japanese original)",
      "url": "https://www.capcom.co.jp/ir/news/html/261022.html",
      "primary": true
    },
    {
      "name": "Capcom official English translation",
      "url": "https://www.capcom.co.jp/ir/english/news/html/e261022.html",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Capcom confirms unauthorized access and password changes",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 19, 2026",
      "title": "Intrusion detected and confirmed"
    },
    {
      "date": "Oct 20, 2026",
      "title": "Data exposure and unauthorized password changes confirmed"
    },
    {
      "date": "Oct 21, 2026",
      "title": "Police and privacy regulator notified"
    },
    {
      "date": "Oct 22, 2026",
      "title": "Public disclosure"
    }
  ],
  "body_markdown": "**L4:** a confirmed mass disclosure. Metadata includes account creation, last login, login count and last-login IP. The 43 additional profiles include birth date, gender, country/region and nickname; both smaller groups are subsets, not extra victims.\n\nCapcom reset the 196 changed passwords. It has not confirmed leakage of customers' original passwords; credit-card data was excluded. Services remain available. The attack method was addressed but not publicly described, and affected customers will be contacted."
}