Capcom data breach: CAPCOM ID email addresses accessed

Capcom says most records are email addresses

CAPCOM ID is the single account players use for Capcom web services, and it is needed to play some Capcom games online.

Capcom counts 11,774,247 records of email addresses and system identifiers, as a worldwide total. Of those, 43 records also held a date of birth, gender, country or region and nickname.

Capcom has not confirmed that any password set by a customer was compromised. It did find that passwords were changed without authorisation on 196 accounts, and those passwords have been reset.

Capcom's notice gives a worldwide total and does not say how many accounts belong to people in the UK or Europe.

Capcom found the access on 19 October and told the police

Capcom says it detected suspicious activity on October 19, 2026, began blocking the access and confirmed the unauthorised access the same day.

On October 21, 2026 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.

Capcom says it has addressed the attack method, and that its games and other services that use CAPCOM ID remain available.

What CAPCOM ID users in the UK can do now

Capcom warns that the information could be used to send fake emails or messages that pretend to come from Capcom. The NCSC says criminals may send messages that pretend to be from an organisation after a recent breach. Such messages may arrive some time after the breach is made public.

To check whether you are affected, the NCSC advises contacting the organisation through its official website or social media. Do not use the links in a message.

If you used the same password elsewhere, the NCSC says to change it on those accounts too. Use a passkey where one is available. It also suggests checking your accounts for changes you did not make, such as new security settings.

In the UK, you can forward a suspicious text message to 7726, a free service.

What happens next

Capcom says it will notify the customers affected, and is still investigating the scope of the impact.

For UK firms, the ICO's guidance sets out the rule. Under UK GDPR an organisation must report certain breaches to the regulator within 72 hours of becoming aware of them, where feasible. When the risk to people is high, it must also tell them without undue delay. The ICO also expects firms to give people advice on how to protect themselves.