Capcom has confirmed that 11,774,247 CAPCOM ID records were exposed in a data breach. A follow-up report on 23 October revealed that attackers also accessed 19 Japanese e-Capcom store accounts, exposing addresses and purchase histories. The company says its games remain playable.
CAPCOM ID connects players to online features in Street Fighter 6, Exoprimal and other Capcom services. Although the company has completed its emergency response, information taken during the breach could still be used for phishing and impersonation.
The latest disclosure separates the wider data exposure from the smaller number of accounts directly accessed by attackers.
Attackers accessed 19 Japanese e-Capcom store accounts
Capcom’s second report, published on 23 October 2026, confirms that attackers entered customer account pages on e-Capcom, the company’s Japanese online store.
The 19 affected accounts belong to customers in Japan. Information exposed through those pages included names, Japanese name readings, telephone numbers, postal addresses, gender, dates of birth, purchase histories, customer-service inquiry histories and saved address books.
This information is more sensitive than the email addresses and account metadata involved in the wider breach. Names, delivery addresses and previous orders could make impersonation attempts against those customers more convincing.
The 19 accounts are not additional cases beyond Capcom’s original figures. They are part of the group of 196 CAPCOM ID accounts whose passwords were changed without authorization.
Capcom says it found no further information exposure resulting from unauthorized password changes on the other affected accounts. Credit card information was not included in the data identified as exposed.
What the 11.7 million affected records contain
Capcom’s initial announcement on 22 October identified 11,774,247 affected records worldwide. These contained email addresses and system information, including account creation dates, last-login timestamps, login counts and the client IP address used for the most recent login.
Another 43 records within that total contained additional profile details: dates of birth, gender, country or region, and nicknames.
Separately, Capcom confirmed unauthorized password changes on 196 accounts. The company has already reset those passwords.
Capcom has not confirmed that passwords originally chosen by customers were leaked. That finding does not erase the unauthorized account changes or the 19 documented store-account cases.
The figures describe different categories of affected records and accounts. They should not be added together or automatically treated as a count of unique individuals.
Street Fighter 6 and other Capcom games remain playable
CAPCOM ID connects supported games and online services to player accounts. Street Fighter 6 uses it for online functionality and linked platform accounts. Exoprimal and selected Resident Evil Portal services also use CAPCOM ID.
Capcom explicitly states that the incident has not affected players’ ability to access or play its games. The company completed emergency measures, and CAPCOM ID services remain available.
That differs from the recent Final Fantasy XIV security interruption, when precautionary maintenance temporarily prevented players from starting new sessions.
For Capcom players, the confirmed consequences involve exposed account information, unauthorized password changes and access to Japanese retail profiles, rather than an ongoing multiplayer outage.
The e-Capcom findings concern information stored in retail customer accounts. They do not establish that Street Fighter 6 characters, online progression or purchases on connected gaming platforms were accessed.
What CAPCOM ID users should do now
Capcom warns that the exposed information could be used in fraudulent emails, text messages or calls impersonating the company and related organizations.
Messages claiming that a CAPCOM ID requires immediate verification, that a game account will be suspended or that a purchase needs confirmation deserve particular caution. Attackers may know an affected email address or account details, making an otherwise suspicious message appear more credible.
Players should open CAPCOM ID directly rather than follow unexpected login links. Suspicious attachments should not be opened. Anyone who notices an unfamiliar account change should contact Capcom through its official support channels.
Changing reused passwords on unrelated services is a sensible precaution. However, Capcom has not confirmed a general leak of customers’ original CAPCOM ID passwords, so a mandatory password change for every player should not be presented as an official instruction.
Capcom says it will contact affected customers individually and has established dedicated support arrangements, including for customers in Europe, the Middle East and Africa.
The intrusion was detected on 19 October
Capcom detected suspicious CAPCOM ID activity on 19 October 2026 and confirmed unauthorized access that day. It began blocking the activity and investigating how it occurred.
On 20 October, the company established an internal incident response team and confirmed exposure of customer information alongside unauthorized password changes. The incident was reported to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on 21 October.
The first public announcement followed on 22 October. It identified the 11.7 million affected records, the 43 records containing additional profile information and the 196 unauthorized password changes.
The second report on 23 October confirmed access to 19 Japanese e-Capcom customer pages and the additional personal information exposed there.
Capcom says it has identified and addressed the method used in the attack and completed its investigation into the scope of the incident. Monitoring and preventative measures will continue.
CAPCOM ID services remain available. The immediate concern for affected players is not an announced gameplay outage, but fraudulent communications that could exploit the information disclosed in the breach.
Sources: Capcom — second incident report, 23 October (Japanese); Capcom — initial disclosure, 22 October; Capcom — official CAPCOM ID services.