Capcom confirms 11.7 million CAPCOM ID accounts compromised, 196 locked out by attackers
On October 22, 2026, Japanese publisher Capcom revealed that its CAPCOM ID authentication service was breached, exposing 11.7 million email addresses and their login metadata, with 196 accounts locked out by the attackers. If you use this account, change your password and beware of targeted emails that will exploit this data.
October 22, 2026. Japanese publisher Capcom confirmed that hackers breached CAPCOM ID, its shared authentication system, exposing more than 11.7 million email addresses and the information associated with them. October 22, 2026. Among the affected accounts, the attackers changed the password on 196 of them to lock their owners out, before the company reset them. October 22, 2026. Passwords for other members and payment data were not exposed, according to the official alert. Why it matters: a breach that contains “only” login metadata is the exact fuel for a targeted phishing campaign that is hard to distinguish from genuine communication. For 11.7 million people, the practical question is no longer whether their address leaked — it is whether the login history attached to it will be weaponized against them.
What was exposed, and why it matters more than it looks
The list of compromised data deserves a close read. Beyond the email addresses, Capcom acknowledges the exposure of account creation date, last login timestamp, number of logins, and the IP address used at the last login. For a subset of 43 accounts, dates of birth, gender, nicknames, and country were also exposed. For 196 accounts, the attackers directly changed the account password to lock out the legitimate owners — a textbook account takeover move, neutralized by the company, which reset those credentials.
No other member passwords or card data were exposed, the alert states. That is reassuring, but it should not obscure the value of login metadata. An email address paired with the last login date, the login volume, and the originating IP address is enough to craft convincing phishing emails: “your last access from this IP address looks suspicious, please sign in again.” The presence of an enriched subset — 43 profiles with date of birth and country — suggests the attackers targeted specific individuals rather than merely vacuuming up a database.
CAPCOM ID is the single account that unlocks the publisher’s web services and part of its online games. For the franchises involved — Resident Evil, Monster Hunter, Street Fighter, Mega Man — a compromised account can expose linked purchases, inventories, and game identities that an attacker can resell or use for targeted harassment. The publisher, which employs 4,000 people with $1.24 billion in annual revenue, did not disclose the attackers’ entry point.
What this leak teaches teams that run identity systems
The incident is a lesson for anyone operating a consumer authentication system. The first lesson concerns the nature of the data deemed “low sensitivity.” Security teams tend to grade a breach by the presence or absence of passwords. But login metadata — timestamps, frequencies, IP addresses — directly feeds spear-phishing and the reconnaissance that precedes an account takeover. A CISO should protect it with the same rigor as the credentials themselves.
The second lesson is about incident response. Capcom detected the lockout maneuver on the 196 accounts and countered it by resetting the passwords — a sound reflex, but one that reveals that account takeover detection relies on monitoring credential changes rather than login failures alone. Organizations that do not log resets and password changes are blind to this class of attack.
The third lesson is regulatory and communicative. A leak of this scale — 11.7 million accounts — triggers notification obligations in most jurisdictions, and the precision of Capcom’s statement (what leaked, what did not, what was done) serves as a model: victims can act immediately instead of speculating.
A fourth lesson concerns the economics of the target. Gaming and entertainment accounts are disproportionately attacked because they carry resale value and are held by users who recycle passwords across services. Defending them is not only a matter of stronger authentication — it is a matter of rate limiting, credential-change monitoring, and account activity alerts that make a stolen account harder to use quietly. And because the leaked metadata lands in attackers’ hands weeks before the phishing wave peaks, the defensive window is short: the organizations that fare best in these breaches treat account security as a product feature, not an afterthought.
Why gaming accounts are worth more than their password
It would be tempting to file this breach under “low impact” because no password leaked at scale. That would be a misreading. A CAPCOM ID account is not just a login: it aggregates digital purchases, game inventories, online saves, and sometimes an entire library. On resale markets, a verified gaming account with a purchase history sells for more than a raw email address, precisely because it carries tangible value.
The leak also feeds credential stuffing at scale. The stolen email addresses will be crossed with other breaches to attempt logins on services where victims reused their password. The login metadata — timestamps, IP addresses — then lets attackers filter for the most active and oldest accounts, the ones worth attacking first. This is the industrial logic of identity fraud: stolen data does not need to be a password to produce an account takeover.
Finally, the subset of 196 accounts locked out by password changes is the most worrying signal. It shows the attackers did not merely exfiltrate — they acted on accounts, with an intent to take over. A database that leaks only addresses is a passive asset; a database where accounts are already being taken is an active incident, and that is exactly what Capcom’s alert describes.
What to do if you have a CAPCOM ID account
Three actions are enough to limit the risk. Change your password now, and enable two-factor authentication if the service offers it — that is the barrier that makes a stolen email address useless for signing in. Be wary of emails posing as Capcom communications in the coming weeks: the leak contains precisely the data that makes a fake email credible, and never click a link received by email to sign in — go through the official site. Check recent activity on your account if the service exposes it, looking for a login or a change you did not initiate.
For everyone else, the guidance is worth repeating: use a password manager to keep a unique password on every service, and treat two-factor authentication as non-negotiable on any account that holds purchases or progress. A breach like this is a reminder that your account is only as safe as the weakest service where you reused a password.
For technical teams, the deeper lesson is this: never downplay a leak of authentication metadata, and treat consumer identity systems as a full-fledged attack surface, with logging of credential changes and monitoring for account takeovers.
Verdict
If you hold a CAPCOM ID account, change your password and enable two-factor authentication, then stay alert for phishing emails that will exploit the stolen metadata. If you run a consumer authentication system, log password changes and resets — that is what let Capcom spot the 196 locked-out accounts — and classify login metadata at the same sensitivity level as credentials, because it is the fuel of targeted phishing. The lesson extends far beyond gaming: in a breach, what makes the difference is not the password itself, but the precision of the data that lets an attacker fool the victim.