Capcom data breach: what to do if you have a CAPCOM ID

If you have a CAPCOM ID, assume the Capcom data breach confirmed on October 22, 2026, exposed your email address, and watch for phishing that uses it. Capcom says the attackers didn’t get passwords or payment card details, so your priority is to avoid fake “Capcom security” emails, then change your password if you reused it anywhere else.

Below: what the attackers took from 11.7 million accounts, the six steps worth doing now, how to spot follow-up scams, and what’s still unknown.

What happened in the Capcom data breach

Capcom spotted suspicious activity on October 19, 2026, and confirmed unauthorized access the same day. By October 20 it had determined that attackers took customer information, and on October 21 it reported the incident to the police and to Japan’s Personal Information Protection Commission. Capcom published its notice on October 22.

The breach covers 11,774,247 CAPCOM ID records worldwide. Players use a CAPCOM ID for online features in games such as Street Fighter 6 and Monster Hunter titles. Capcom says the breach didn’t disrupt its online services, which remain available.

What the Capcom data breach exposed

Data	Exposed?	Who is affected
Email address	Yes	About 11.7 million accounts
Account creation date, last login date, login count	Yes	About 11.7 million accounts
IP address of the most recent sign-in	Yes	About 11.7 million accounts
Date of birth, gender, country or region, nickname	Yes	43 accounts
Password	No, according to Capcom	Except 196 accounts whose passwords attackers changed
Credit card data	No, according to Capcom	None

For 196 accounts, attackers changed the password and locked out the owner. Capcom has reset those accounts. It has not explained how the attackers changed those passwords, how they got into its systems, or when the intrusion began.

Capcom data breach: what to do now

1. Wait for Capcom’s notice, but verify it. Capcom is notifying affected customers in stages because of the number of accounts. A real notice will not ask for your password or payment details. If an email asks you to “confirm” anything, ignore its links and sign in at cid.capcom.com directly.
2. Check that you can still sign in. Go to cid.capcom.com and sign in. If your password no longer works, use the official support form for your region from Capcom’s notice rather than any link in an email.
3. Change your CAPCOM ID password. Capcom says the attackers didn’t get passwords, so this is a precaution. Use a password you have never used elsewhere.
4. Change reused passwords elsewhere. If you also use your CAPCOM ID password on Steam, PlayStation Network, Xbox or your email account, change those first. Your email account matters most, because it can reset everything else.
5. Turn on two-step verification on linked accounts. We could not confirm that CAPCOM ID offers its own two-step option. Steam Guard, PlayStation Network and Xbox (Microsoft account) all do, and so do Gmail and Outlook. Our guide to turning on two-step verification for Google and Microsoft accounts covers both email providers.
6. Note the date. If you see unfamiliar logins or purchases on gaming accounts in the coming weeks, being able to say “after the October 2026 Capcom breach” helps support teams.

How to spot Capcom data breach scams

The leaked data is limited, but it is enough for convincing phishing: a scammer knows your email address, that you play Capcom games, roughly when you created the account and when you last signed in. Expect messages like these:

• “Your CAPCOM ID has been compromised. Verify your account within 24 hours.” Real notices do not set deadlines that require clicking a link.
• Offers of compensation, free in-game currency or a free game “for affected players”, asking you to sign in through a link.
• Fake Steam, PlayStation or Xbox security alerts timed to the breach news.
• Texts or messages directing you to a “breach check” site that asks for your password.

If a message pushes you to act fast through a link, treat it as a scam. The same rules apply as for fake package delivery texts: check the sender, do not use the link, and go to the official site yourself. Fake verification pages that tell you to paste a command into Windows are also common; Chrome’s ClickFix protection can block some of them.

What we still don’t know

• How the attackers got in. Capcom says it identified and closed the entry point but has not described it.
• When the intrusion started.
• Who is behind it. No group had claimed responsibility as of October 26, 2026.
• Whether this connects to Capcom’s 2020 ransomware attack. Nothing published links the two.

FAQ

Did the Capcom data breach leak my password?

Capcom says the attackers didn’t get passwords, apart from 196 accounts where they changed the password. Changing it is still a sensible precaution, especially if you reused it.

Did hackers steal my credit card information?

No. Capcom says the breach didn’t affect credit card information.

How do I know if the breach affected my CAPCOM ID?

With 11.7 million records involved, assume yes if you have an account. Capcom is emailing affected customers in stages, so you may not have received a notice yet.

Is it safe to keep playing Capcom games online?

Yes. Capcom says its online services still work normally. The main risk is phishing aimed at your email address, not playing the games.

Do this first

Open your email account’s security settings now and confirm two-step verification is on. It is the account that can reset every gaming login you have, and it is the address the attackers now hold.

Related guides

• Quest Diagnostics Data Breach: What Patients Should Do Now
• Steam Stuck on “Loading User Data”? Fixes That Work
• DreamHost Password Reset: What to Do After the Incident

Sources

Checked on October 27, 2026, against Capcom’s official notice and reporting by BleepingComputer and Hardware Busters. Capcom’s investigation is ongoing and details may change. We could not confirm whether CAPCOM ID offers two-step verification.

• Capcom: official notice of unauthorized access (October 22, 2026)
• BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts (October 22, 2026)
• Hardware Busters: Capcom ID data breach exposes 11.7 million accounts