INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Capcom Exposes Users' Personal Information

| 2026-10-23 11:45 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 21, Capcom detected suspicious activity involving its CAPCOM ID account system and immediately moved to block the access, investigate the cause and scope of the incident. The company then confirmed that unauthorized access had occurred and began identifying and addressing the attack method. By this point, certain customer information registered with CAPCOM ID had been accessed without authorization, affecting approximately 11,774,247 records of email addresses and system-specific identifier information. Capcom also discovered that passwords associated with a limited number of accounts had been changed without permission on 196 customer accounts. The company has since reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission and implemented emergency response measures to address the attack method, which was identified by October 21.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
JP
Incident Timeline
‎October 19, 2026
Threat actors used unknown methods to target Capcom's CAPCOM ID account system, exposing users' personal information.
tactic Data Breach
The company also confirmed that services using CAPCOM ID, including its games, remain available Timeline of Capcom Data Breach and Company Response Capcom detected suspicious activity involving its CAPCOM ID account system on October 19, 2026, indicating potential unauthorised access.
organisation Capcom Data Breach
The company also confirmed that services using CAPCOM ID, including its games, remain available Timeline of Capcom Data Breach and Company Response Capcom detected suspicious activity involving its CAPCOM ID account system on October 19, 2026, indicating potential unauthorised access.
organisation Shutterstock.com
Image credits: Bangla press / photo_gonzo / Shutterstock.com
‎October 20
Capcom established an internal incident response headquarters on October 20 to coordinate its investigation and prevent further impact.
‎October 21
Capcom reported a data breach to the Osaka Prefectural Police and Japan's Personal Information Protection Commission, exposing users' personal information.
target_region Japan
By October 21, Capcom had completed emergency response measures and identified and addressed the attack method and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
attribution the Osaka Prefectural Police
By October 21, Capcom had completed emergency response measures and identified and addressed the attack method and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
‎October 22
Threat actors used unauthorized access to target users' personal information associated with CAPCOM ID.
source_region Japan
In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.
organisation CAPCOM ID
In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.
organisation IP
As of October 22, Capcom estimated that the data compromised include: 11,774,247 records of email addresses and system-specific identifier information (e.g. date and time of account creation, date and time of last login, number of logins, client IP address used during last login) 43 records of date of birth, gender, country/region and nickname Capcom has not confirmed any compr…
data_breach 11,774,247 records
As of October 22, Capcom estimated that the data compromised include: 11,774,247 records of email addresses and system-specific identifier information (e.g. date and time of account creation, date and time of last login, number of logins, client IP address used during last login) 43 records of date of birth, gender, country/region and nickname Capcom has not confirmed any compr…
data_breach 43 records
As of October 22, Capcom estimated that the data compromised include: 11,774,247 records of email addresses and system-specific identifier information (e.g. date and time of account creation, date and time of last login, number of logins, client IP address used during last login) 43 records of date of birth, gender, country/region and nickname Capcom has not confirmed any compr…
‎2026/10/23
Threat actors used unauthorized access to change passwords on 196 customer accounts without explicit authorization from Capcom.
organisation Capcom
Capcom, the gaming giant behind Resident Evil, Street Fighter and Monster Hunter, has warned that players’ personal information may have been compromised following a data breach.
organisation Resident Evil
Capcom, the gaming giant behind Resident Evil, Street Fighter and Monster Hunter, has warned that players’ personal information may have been compromised following a data breach.
victims 196 customer accounts
However, it has observed that passwords were changed without authorization on 196 customer accounts.
Tactical Metrics
Metrics
data_breach
11,774,247
Records
As of October 22, Capcom estimated that the data compromised include: 11,774,247 records of email addresses and system-specific identifier information (e.g. date and time of account creation, date and time of last login, number of logins, client IP address used during last login) 43 records of date of birth, gender, country/region and nickname Capcom has not confirmed any compr…
Metrics
data_breach
43
Records
As of October 22, Capcom estimated that the data compromised include: 11,774,247 records of email addresses and system-specific identifier information (e.g. date and time of account creation, date and time of last login, number of logins, client IP address used during last login) 43 records of date of birth, gender, country/region and nickname Capcom has not confirmed any compr…
Metrics
victims
196
Customer Accounts
However, it has observed that passwords were changed without authorization on 196 customer accounts.
Intelligence Sources
Infosecurity-Magazine 2026-10-23