Capcom, the gaming giant behind Resident Evil, Street Fighter and Monster Hunter, has warned that players’ personal information may have been compromised following a data breach.

In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.

CAPCOM ID is a unified account operated by Capcom that players can use to play Capcom-licensed games online as well as to access various web services.

As of October 22, Capcom estimated that the data compromised include:

• 11,774,247 records of email addresses and system-specific identifier information (e.g. date and time of account creation, date and time of last login, number of logins, client IP address used during last login)
• 43 records of date of birth, gender, country/region and nickname

Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves. However, it has observed that passwords were changed without authorization on 196 customer accounts.

“The passwords associated with these accounts have already been reset, and the company continues to investigate the scope of any impact resulting from this incident,” the company said.

It also confirmed that credit card information remains unaffected by the breach.

Capcom has warned that the affected information could potentially be misused in fraudulent emails or other communications impersonating the company or related parties.

It has advised customers to exercise caution when receiving suspicious messages and avoid clicking on links or opening attachments.

The company also confirmed that services using CAPCOM ID, including its games, remain available

Timeline of Capcom Data Breach and Company Response

Capcom detected suspicious activity involving its CAPCOM ID account system on October 19, 2026, indicating potential unauthorised access.

The company said it immediately moved to block the access, investigate the cause and scope of the incident, and implement emergency response measures. Later that day, Capcom confirmed that unauthorised access had occurred and began identifying and addressing the attack method.

On October 20, Capcom established an internal incident response headquarters to coordinate its investigation and prevent further impact.

The investigation confirmed that certain customer information registered with CAPCOM ID had been accessed without authorisation. The company also discovered that passwords associated with a limited number of accounts had been changed without permission.

Capcom subsequently reported the incident to its external Information Technology Security Oversight Committee.

By October 21, Capcom had completed emergency response measures and identified and addressed the attack method and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.

Image credits: Bangla press / photo_gonzo / Shutterstock.com