CAPCOM ID breach exposes 11,774,247 email and account-metadata records
Capcom confirms 11,774,247 exposed email/account-metadata records. Within that total, 43 records include additional profile data and 196 accounts had passwords changed without authorization.
- Disclosed
- Oct 22, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- CAPCOM ID members worldwide; record count is not a verified count of unique people
- capcom
- In the wild
- Yes
- Capcom confirms unauthorized access and password changes
What happened
L4: a confirmed mass disclosure. Metadata includes account creation, last login, login count and last-login IP. The 43 additional profiles include birth date, gender, country/region and nickname; both smaller groups are subsets, not extra victims.
Capcom reset the 196 changed passwords. It has not confirmed leakage of customers’ original passwords; credit-card data was excluded. Services remain available. The attack method was addressed but not publicly described, and affected customers will be contacted.
Crime-scene timeline
Oct 19, 2026
Intrusion detected and confirmed
Oct 20, 2026
Data exposure and unauthorized password changes confirmed
Oct 21, 2026
Police and privacy regulator notified
Oct 22, 2026
Public disclosure
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.