Capcom Confirms Data Breach Affecting 11.7 Million CAPCOM ID Accounts

CAPCOM ID is a free, unified account that lets users access various games and online services. The service has more than 10 million users, and Capcom published a security advisory on its Japanese site saying a third party accessed the service, “resulting in the leakage of some customer information to external parties.” In a machine-translated warning, the company said, “We deeply apologize for the great inconvenience and concern caused to our customers and all stakeholders.”

Analysis of the breach determined that the threat actors obtained 11,774,247 user email addresses and system-specific identification information, including account creation date and time, last login date and time, number of login counts, and client IP at last login. For 43 users, the attackers also obtained dates of birth, gender information, nicknames, and data on country and region. For 196 people, the attackers changed passwords in an attempt to lock legitimate users out of their accounts. The passwords themselves were not leaked, and Capcom said it triggered the password reset process and restored the accounts to their rightful owners. Credit card information was not included in the leak target, the company said.

Capcom did not discuss the identity of the attackers or the nature of the breach. TechRadar said it was unknown whether the attackers stole an employee’s login credentials through phishing or exploited a vulnerability such as the php2shell flaw, or whether they tried to contact or extort Capcom. No threat actors had claimed responsibility on the dark web or shared samples or the full database, according to the report. Capcom said it notified the police and other relevant authorities, and that the investigation continues.

Capcom has had cybersecurity incidents before. In November 2020, the Ragnar Locker ransomware group obtained a terabyte of sensitive data, and the company later said the attackers broke in through an old VPN device and confirmed the breach affected 390,000 people. As of March 2026, Capcom employed almost 4,000 people worldwide. In fiscal 2025, its games sold 51.87 million units, and fiscal 2026 annual revenue reached $1.3 billion.

Capcom urged users to be vigilant and wary of incoming email messages, especially those containing references to the company. TechRadar noted that email addresses alone are not enough for a serious cyberattack but can help attackers craft tailored phishing messages that may lead to ransomware infections, infostealers, or business email compromise.