Featured image: official Resident Evil Requiem screenshot by Capcom via the Steam store page
Capcom has apologized to players after confirming that an unauthorized third party got into data tied to its Capcom ID system. The number is big: 11,774,247 records. That makes this one of the largest account-data incidents a games publisher has disclosed this year, and it touches the login that sits behind much of Capcom’s modern catalog.
The good news is that the company says no credit card details were involved and that it has not confirmed any player’s own password was exposed. The less comfortable news is that millions of email addresses are now in someone else’s hands, and Capcom itself is warning about fake emails. Here is what was disclosed, what the numbers actually mean, and what is worth doing tonight.
The short version
- Disclosed: October 22, 2026, with a public apology from Capcom
- Scale: 11,774,247 Capcom ID records worldwide
- Exposed for most accounts: email address plus account metadata such as creation date, last login time, login count and the IP address of the last login
- Exposed for 43 accounts: date of birth, gender, country or region and nickname
- Tampered with: passwords were changed without authorization on 196 accounts, and Capcom has reset them
- Not affected: credit card information, according to Capcom
- Games: services that use Capcom ID remain online and playable
What Capcom actually said
Capcom’s notice says a third party accessed CAPCOM ID data without authorization. The company reports that it has finished its emergency response, identified the method used in the attack and dealt with it. It plans to contact affected customers directly, keep investigating and strengthen its security. Capcom did not say who was behind the intrusion, and no group had been publicly tied to it at the time of writing.
Coverage from outlets such as VGC, GamesRadar and Windows Central lines up on the core figures. One small discrepancy: Windows Central reports 193 tampered accounts, while most other outlets cite 196, so I am going with 196.
The timeline
Based on the reporting so far, the response moved quickly. One report says Capcom spotted traces of unauthorized access on October 19 and blocked it, and the rest of the sequence is consistent across outlets. Treat the first date as less firmly confirmed than the other three.
| Date | What happened |
|---|---|
| October 19 | Traces of unauthorized access reportedly detected and blocked |
| October 20 | Internal task force set up to investigate |
| October 21 | Incident reported to Osaka Prefectural Police and Japan’s Personal Information Protection Commission |
| October 22 | Public disclosure and apology to players |
What leaked, and what did not
The headline number sounds scarier than the data it describes, but it still matters. For the vast majority of the 11.77 million records, the exposed fields are an email address and account activity details. That is not nothing: an email address plus the knowledge that you play Capcom games is exactly what a phisher wants. A last-login IP address also reveals roughly where you were connecting from.
Capcom ID breach, in proportion
Shares of the 11,774,247 affected records. The two small groups are drawn at a minimum visible width, not to scale.
The first group is “about” because the three groups described by Capcom may overlap, so the exact split is not published. The point of the chart is the shape: nearly everything sits in the email-and-metadata bucket, and the sensitive cases are a rounding error by comparison.
| Data type | Status |
|---|---|
| Email address | Exposed |
| Account creation date, last login, login count | Exposed |
| IP address of last login | Exposed |
| Birth date, gender, country, nickname | Exposed for 43 accounts |
| Passwords you set yourself | Not confirmed as compromised |
| Credit card information | Not affected, per Capcom |
The 196 changed passwords
This is the detail that deserves the most attention. In 196 cases, someone changed the password on an account they should not have been able to touch. Capcom says it has already reset those passwords. That suggests the attacker had more than read access in at least some cases, which is why the company’s wording that it has “not confirmed” that original passwords were compromised is careful rather than a flat denial. If you got a password reset email you did not ask for, treat it as real and act on it.
Why phishing is the real danger
Capcom’s own warning is about fraudulent email. That is the sensible thing to focus on. A list of millions of verified addresses, all linked to a gaming account, is ideal material for fake “security notice” or “verify your account” messages. Those emails will look more convincing now, because they can reference a real event that really did happen to you.
Capcom also has a history here. In November 2020 the publisher was hit by a Ragnar Locker ransomware attack, and it later said up to about 390,000 people could have been affected, with 16,415 confirmed at one point. It refused to pay the reported $11 million ransom. The new incident involves roughly 30 times as many records, though the kind of data is different: mostly email and activity data, not names and addresses.
Capcom’s two big security incidents
People or records affected. The 2020 figure is the “up to” estimate Capcom gave after its ransomware attack.
What this means for players
Capcom says every service that uses Capcom ID is still working, so there is no outage to wait out. That includes the online side of current releases. If you recently picked up Onimusha: Way of the Sword, jumped into Monster Hunter Wilds or followed the news about the cut Resident Evil voice lines, there is a decent chance your address is on this list. Nobody has said which games are most affected, and I have not seen any outlet name specific titles as the source of the leak.
What to do right now
- Change your Capcom ID password. Capcom has not confirmed that player-set passwords leaked, but it costs two minutes and removes the doubt.
- Do not reuse that password anywhere else. If you did, change it on those sites too, starting with email.
- Turn on two-factor authentication on your email account, since that is the account attackers would want most.
- Ignore links in unexpected Capcom emails. If a message claims to be about the breach, go to the official Capcom site by typing the address yourself.
- Check for a notification from Capcom. The company says it will contact affected customers directly. A real notice will not ask for your password or card number.
- Watch for password reset emails you did not request, which could mean someone is trying your account.
My take
Capcom handled the disclosure about as well as these things usually go. It reported to the authorities within days, named the numbers, apologized plainly and told people exactly what risk to watch for. That is better than many publishers manage. The part that bothers me is the 196 tampered accounts. Reading data is one problem. Changing passwords means the attacker could act inside the system, and the company has only said it addressed the method, not what the method was.
Until Capcom publishes more detail, the practical advice is boring and effective: new password, two-factor on your email, and zero clicks on surprise messages. If more information comes out about how the attacker got in, I will update this story.
Sources: VGC, GamesRadar, Windows Central, EventHubs, FandomWire, BleepingComputer (2020 incident), Steam.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
