Capcom data breach: what Capcom ID users should do

What happened

Capcom says it noticed unauthorized access to Capcom ID, the shared account it uses for its websites and some online games, on October 19, 2026, and began blocking it. It formed an internal response team on October 20 and reported the incident to police and Japan's privacy regulator on October 21. Capcom says gameplay and services that use Capcom ID are still working normally, and it is contacting affected customers individually.

Capcom found unauthorized password changes on 196 accounts and reset those passwords. It hasn't said how the attackers got in.

What information was exposed

For about 11.7 million accounts:

• Email address
• Account creation date, last login date, and number of logins
• IP address of the most recent login

For 43 accounts, birth date, gender, country or region, and nickname were also exposed. Capcom says credit card information was not included.

What to do now

1. Expect phishing. Your email address and the fact that you play Capcom games are now in attackers' hands. Be suspicious of emails about your Capcom account, "free" game items, or account problems, including ones that look like they come from PlayStation, Xbox, Steam, or Nintendo.
2. Don't click links in those emails. Go to the Capcom ID site or your console's store directly and sign in there.
3. If you used your Capcom ID password on any other site, change it on those sites, and use a different password for each one. A password manager makes this easy.
4. Turn on two-factor authentication for your PlayStation, Xbox, Steam, Nintendo, and email accounts if you haven't already.
5. No Social Security numbers or card numbers were involved, so a credit freeze isn't needed for this breach.

Ask Capcom to delete your data

If you no longer play Capcom's online games, closing your Capcom ID means one fewer place your email and login history are stored. We couldn't confirm Capcom's current account deletion steps, so check the Capcom ID help pages or contact Capcom's support and ask for your account and data to be deleted. Deleting your account may remove access to linked game data, so check what's tied to it first.

Your legal right to deletion

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, covered companies generally have to honor your deletion request within the deadline your state sets. See what your state's law requires.

Sources: Capcom's statement, Notebookcheck, and CyberInsider. DataTrail isn't affiliated with Capcom. This page is general information, not legal advice.