What to Do After the Capcom Data Breach (2026)

If you have a CAPCOM ID, assume your email address was exposed. Capcom confirmed on October 19, 2026 that attackers copied 11,774,247 account records containing emails, login history and last-login IP addresses. Passwords and payment cards were not taken, so the main risk is phishing: change your password, enable two-factor authentication, and distrust any "Capcom" email.

What Happened in the Capcom Breach

Capcom, the publisher behind Resident Evil, Monster Hunter and Street Fighter, detected suspicious activity on its CAPCOM ID service on October 19, 2026 and confirmed unauthorized access the same day. CAPCOM ID is the single sign-on account used for Capcom's websites, the e-Capcom store and several online games, so the breach spans players worldwide rather than one title.

• October 19: suspicious access detected and confirmed
• October 20: Capcom set up an incident response headquarters and briefed an external security oversight committee
• October 21: the incident was reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission

Capcom says it has blocked the attack method and that CAPCOM ID and its games remain online. The investigation is ongoing, and no group had publicly claimed the attack as of October 23. This is Capcom's second major incident after a 2020 ransomware attack that hit up to 350,000 people.

What Data Was Exposed

According to Capcom's disclosure, the stolen records include:

• Email addresses for all 11.7 million records
• Account metadata: creation date, last login time, login count, and the IP address of the most recent sign-in
• For 43 records only: date of birth, gender, country or region, and nickname

Capcom says it found no evidence that passwords were compromised and that credit card information was not affected. However, attackers did change the passwords on 196 accounts without permission, and reached the e-Capcom store account pages of 19 customers. Capcom has reset those passwords.

Step 1: Change Your CAPCOM ID Password

Go to Capcom's site directly (type the address, do not click an email link), sign in, and set a new, unique password. If you reused your CAPCOM ID password anywhere else, change it there too. The 196 hijacked accounts show attackers already had working credentials for some users, most likely from older breaches, which is why credential stuffing is the bigger threat than the leak itself.

Step 2: Turn On Two-Factor Authentication

Enable two-step verification on your CAPCOM ID and, more importantly, on the email account tied to it. If your email is protected by an authenticator app or passkey, a stolen address alone cannot be turned into an account takeover. Our guide to setting up two-factor authentication everywhere walks through the major platforms.

Step 3: Check Linked Platform Accounts

Review the Steam, PlayStation, Xbox or Nintendo accounts you have linked to Capcom. Confirm no unfamiliar devices or sessions are signed in and that recovery emails and phone numbers are still yours. If something already looks wrong, follow our steps for recovering a hacked gaming account.

Step 4: Watch for Fake Capcom Emails

Expect phishing that offers "compensation," free in-game items, or an urgent account verification. Do not open links or attachments in any unexpected Capcom message. Capcom says affected customers will be notified, but you should always reach your account by typing Capcom's address yourself. Our guide to recognizing phishing scams covers the warning signs.

Step 5: Check Where Else Your Email Is Exposed

Your email is probably already in other breach dumps and on people-search sites that tie it to your name, phone and home address. That combination is what turns a gaming leak into identity fraud. Run a check to see whether your information is on the dark web, and consider removing the broker listings that make you easy to target.

Is the Capcom Breach Dangerous for Most Players?

For the vast majority of users the direct risk is low: no passwords, no card numbers and, for all but 43 people, no birth dates were taken. The realistic harms are targeted phishing, spam, and account takeovers for people who reuse passwords. If you change your password, use 2FA and stay skeptical of email, you have closed off nearly all of it.

Frequently Asked Questions

Was my Capcom password stolen?

Capcom says it found no evidence that customer passwords were compromised. However, attackers changed the passwords of 196 accounts, which Capcom has since reset. Changing your CAPCOM ID password now, and anywhere you reused it, is the safest move.

How many people were affected by the Capcom data breach?

Capcom reported 11,774,247 CAPCOM ID records worldwide. Nearly all contained only an email address and login metadata; 43 also included date of birth, gender, country and nickname.

Was my credit card exposed in the Capcom breach?

No. Capcom states that payment card information was not affected. You do not need to cancel cards because of this incident, though checking statements is always sensible after any breach.

How do I know if my Capcom account was affected?

Capcom says it will notify affected customers. Given that nearly all CAPCOM ID accounts appear to be in scope, it is safest to assume yours is included and secure it now. You can contact Capcom through its regional support forms for the Americas and EMEA.

Are my Capcom games still safe to play?

Yes. Capcom says games and multiplayer services were not affected and CAPCOM ID remains available. The breach concerns account data, not game servers or saves.

What should I do if I get an email from Capcom about the breach?

Do not click links or open attachments in it. Go to Capcom's official site by typing the address yourself and check your account there. Scammers are expected to send fake breach notices and "compensation" offers.