Capcom account breach exposed 11.7 million emails. Be careful with surprising Capcom messages

Capcom runs the CAPCOM ID account, which players need for online play in some Capcom games. On October 19, 2026, it found that someone had entered the account service without permission.

On October 22, the company reported the size of the break-in. Attackers accessed 11,774,247 records. Most of them held an email address and details about account use, such as the time of the last sign-in.

Capcom says 43 records also held a date of birth, a country or region, and a nickname.

Attackers changed passwords on 196 accounts without the owners' knowledge. Capcom reset those passwords. It found no proof that the passwords you chose were taken, and no credit card numbers were in the exposed records.

The company warned that scammers can use those email addresses to send fake Capcom messages.

This report matters to people who made a CAPCOM ID account. Some Capcom games need this account for online play.

A fake Capcom email can be hard to spot. Scammers can reuse the real email address you used to sign up.

Scammers often pretend to be a trusted company to steal a password or a sign-in code. That is why the warning matters.

We do not know that anyone used your email address this way. The risk is real, so caution is the right step.

Capcom did not say how the attacker entered the account service.

We do not know whether someone used your email address to send a fake Capcom message.

Capcom is still checking the full effect of the break-in. It said it will tell affected customers.