# Capcom data breach: CAPCOM ID email addresses accessed

Capcom says no card details were taken, but anyone with a CAPCOM ID should watch for fake emails in Capcom's name.

The Assurance Desk, news. Published 23 October 2026.

Capcom said on October 22, 2026 that a third party had accessed customer information linked to CAPCOM ID, its online membership account. The records hold email addresses and account details, and Capcom says credit card information was not affected ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

## Capcom says most records are email addresses

CAPCOM ID is the single account players use for Capcom web services, and it is needed to play some Capcom games online ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

Capcom counts 11,774,247 records of email addresses and system identifiers, as a worldwide total. Of those, 43 records also held a date of birth, gender, country or region and nickname ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

Capcom has not confirmed that any password set by a customer was compromised. It did find that passwords were changed without authorisation on 196 accounts, and those passwords have been reset ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

Capcom's notice gives a worldwide total and does not say how many accounts belong to people in the UK or Europe ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

## Capcom found the access on 19 October and told the police

Capcom says it detected suspicious activity on October 19, 2026, began blocking the access and confirmed the unauthorised access the same day ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

On October 21, 2026 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

Capcom says it has addressed the attack method, and that its games and other services that use CAPCOM ID remain available ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

**How Capcom says the incident unfolded**

- October 19, 2026, Global: Capcom detects suspicious activity on CAPCOM ID and confirms unauthorised access
- October 21, 2026, Global: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission
- October 22, 2026, Global: Capcom publishes its notice

Dates as Capcom's notice gives them. The investigation continues.

Source: capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM, https://www.capcom.co.jp/ir/english/news/html/e261022.html (checked 23 October 2026)

## What CAPCOM ID users in the UK can do now

Capcom warns that the information could be used to send fake emails or messages that pretend to come from Capcom. The NCSC says criminals may send messages that pretend to be from an organisation after a recent breach. Such messages may arrive some time after the breach is made public ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html) and [NCSC, Data breach guidance for individuals](https://www.ncsc.gov.uk/guidance/data-breaches), checked 23 October 2026).

To check whether you are affected, the NCSC advises contacting the organisation through its official website or social media. Do not use the links in a message ([NCSC, Data breach guidance for individuals](https://www.ncsc.gov.uk/guidance/data-breaches), checked 23 October 2026).

If you used the same password elsewhere, the NCSC says to change it on those accounts too. Use a passkey where one is available. It also suggests checking your accounts for changes you did not make, such as new security settings ([NCSC, Data breach guidance for individuals](https://www.ncsc.gov.uk/guidance/data-breaches), checked 23 October 2026).

In the UK, you can forward a suspicious text message to 7726, a free service ([NCSC, Data breach guidance for individuals](https://www.ncsc.gov.uk/guidance/data-breaches), checked 23 October 2026).

**What to do if you have a CAPCOM ID**

- Check whether you are affected through Capcom's official website, not a link in a message
- Watch for fake messages in Capcom's name, which may come some time later
- Change any password you used on CAPCOM ID and anywhere else, or use a passkey
- Check your other accounts for changes you did not make
- Forward a suspicious text message to 7726

From the NCSC's guidance for people after a data breach. It is general advice, not Capcom's.

Source: NCSC, Data breach guidance for individuals, https://www.ncsc.gov.uk/guidance/data-breaches (checked 23 October 2026)

## What happens next

Capcom says it will notify the customers affected, and is still investigating the scope of the impact ([capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM](https://www.capcom.co.jp/ir/english/news/html/e261022.html), checked 23 October 2026).

For UK firms, the ICO's guidance sets out the rule. Under UK GDPR an organisation must report certain breaches to the regulator within 72 hours of becoming aware of them, where feasible. When the risk to people is high, it must also tell them without undue delay. The ICO also expects firms to give people advice on how to protect themselves ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 23 October 2026).

## Read next

- [Data protection: the section](https://theassurancedesk.com/data-protection)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report)
- [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call)
- [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim)
- [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach)

## Sources

- capcom.co.jp, Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Press Release, CAPCOM: https://www.capcom.co.jp/ir/english/news/html/e261022.html (checked 23 October 2026)
- NCSC, Data breach guidance for individuals: https://www.ncsc.gov.uk/guidance/data-breaches (checked 23 October 2026)
- ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.