Capcom data breach: Hackers expose 1.17 crore emails, change passwords of 196 accounts

Japanese gaming giant Capcom has confirmed a major data breach affecting more than 1.17 crore email addresses worldwide. The company, known for popular gaming franchises including Resident Evil, Street Fighter and Monster Hunter, said hackers gained unauthorised access to its CAPCOM ID membership service. The breach exposed 11,774,247 records containing email addresses and account-related information, raising concerns about phishing scams targeting gamers.

Capcom disclosed the incident on October 22, 2026, after discovering suspicious activity on October 19. An investigation subsequently revealed that hackers had accessed customer information and changed the login passwords of 196 accounts without permission. The company has since taken emergency security measures and started notifying affected customers. According to Capcom, credit card information was not exposed.

:

What happened in the Capcom data breach?

The attack targeted CAPCOM ID, an online account system that connects players to several Capcom games and web services.

Capcom signs of suspicious access on October 19 and blocked the activity. By October 20, investigators had confirmed that customer information had leaked.

The company subsequently notified Japanese police and privacy authorities. Investigators are still examining the incident’s full impact.

What information did hackers steal?

The breach primarily involved email addresses and technical information associated with user accounts.

The leaked account information included registration dates, last login times, login counts and IP addresses used during previous logins.

For 43 records, hackers obtained additional details such as dates of birth, gender, country or region and nicknames.

Capcom says investigators have found no evidence that users’ original passwords were leaked. The company has reset the passwords of the 196 affected accounts.

Are Resident Evil and Street Fighter players affected?

Anyone using CAPCOM ID could potentially be affected.

The account system supports services associated with games including Street Fighter 6 and Resident Evil.

Capcom says its games remain playable and CAPCOM ID services continue operating.

The company has not disclosed the attackers’ identities or the exact method used to enter its systems.

:

What should Capcom users do now?

The biggest immediate concern is phishing. Criminals could use stolen email addresses to send convincing messages pretending to come from Capcom.

Users should avoid suspicious login links, check account activity and enable two-factor authentication where available. Changing reused passwords is another sensible precaution.

Capcom has begun contacting affected customers individually and established a dedicated inquiry service.