Capcom ID Breach Follows the 2020 Ransomware Failure

Capcom said a third party reached 11,774,247 CAPCOM ID records worldwide and changed 196 login passwords. The Osaka publisher posted the figures on October 22, three days after it found the intrusion on the membership service that Street Fighter 6, Resident Evil Portal, and the Capcom Town Store share.

Emails went out with account-creation times, last-login times, login counts, and the IP used on the last sign-in. Capcom says cards were not in the haul, and it has not confirmed that passwords players set themselves leaked. The 196 already-reset logins are the part that shows the break-in was used, not only copied.

Capcom Confirms 11,774,247 Capcom ID Records Were Reached

President Haruhiro Tsujimoto signed a notice and apology dated October 22 for CAPCOM ID, the free unified account for Capcom games and web services. The company is listed on the Tokyo Stock Exchange Prime market as 9697 and is based at 3-1-3 Uchihiranomachi, Chuo-ku, Osaka.

Of the 11,774,247 records, 43 also exposed date of birth, gender, country or region, and nickname. Those 43 sit inside the larger set. So do the 196 accounts whose passwords were changed without permission. Capcom has already reset those 196 passwords and says it is still mapping the rest of the damage.

The login layer is still up. Street Fighter 6, Exoprimal, Monster Hunter Puzzles: Felyne Isles, Resident Evil Portal, and the Capcom Town Store, which sells Steam keys and GOG codes, all sit behind that same account. Capcom says play is unaffected.

THE OCTOBER CLOCK

1. October 19, 2026: Capcom finds traces of suspected unauthorized access, blocks it, and confirms the intrusion the same day. Emergency steps start, and work begins on the attack method. CAPCOM ID also lists system maintenance from 10:00 to 11:30 UTC, a 90-minute window on that Monday.
2. October 20, 2026: An internal task force is stood up. Investigators confirm that some customer information leaked and that some passwords were changed, then report the matter to the Information Technology Security Oversight Committee, Capcom’s external advisory body.
3. October 21, 2026: The company reports the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission, then keeps watching the systems.
4. October 22, 2026: Tsujimoto’s notice goes public. Capcom says emergency measures are done and that it has identified and addressed the attack method, which it does not describe.

The maintenance note and the detection share a date. Capcom has not said the 90-minute window was the patch. It has said the method is handled and that CAPCOM ID services, including games, remain available.

196 Passwords Changed Hands Before the Reset

The headline count is mail and login metadata. The live wound is smaller and worse. Someone with access changed passwords on 196 accounts before Capcom cut that off and forced new ones.

That is account takeover, not a copy of a list. Capcom’s own wording draws the line: it has not confirmed any compromise of CAPCOM ID login passwords originally set by customers themselves, yet it has confirmed those 196 changes. The two facts can sit together if the attackers reset passwords through a session, a recovery path, or an admin function rather than by dumping the password file. The notice does not say which.

The rest of the dump is built for the next step. An email, a last-login time, a login count, and a last-login IP let a fake Capcom message name a real account and a real machine. That is a working phishing kit, even when the original password hash never moves. Recaps that told every player to reset on the spot went further than Capcom did. The company reset the 196, left other registered mailboxes in place, and told people not to click strange links.

If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.

Capcom Co., Ltd., notice and apology, October 22, 2026

Capcom will start contacting affected customers. Those real messages will land in the same inboxes as the fakes, which is the awkward part of notifying 11,774,247 people by the channel that just leaked.

Ragnar Locker’s 2020 Raid Hit Internal Files

This is Capcom’s second public cyber incident that ended in a customer apology from the same president. The last one was a different machine.

In the early morning of November 2, 2020, Capcom found trouble on its internal network, shut systems down, and later confirmed a tailored ransomware attack that destroyed and encrypted server data. A group calling itself Ragnar Locker left a message demanding ransom. Capcom contacted the Osaka Prefectural Police. A first network-issues notice went out on November 4, 2020. The fuller November 16, 2020 ransomware update said some personal information had been taken and that a potential maximum of about 350,000 people, from Japan help-desk callers to shareholders and job applicants, might have been exposed. Logs had been deleted, so the ceiling was a ceiling, not a count.

By January 12, 2021, Capcom had verified 16,415 people as compromised, 9 of them from the November figure plus 16,406 more, mostly employees, former staff, and business partners. An April 13, 2021 investigation notice then cut the verified total by 766, to 15,649. Cards were not in that haul either, because payments ran through a third-party provider. Online play stayed up then, too.

TWO CAPCOM BREACHES, TWO LAYERS

The 15,649 figure is people whose personal files Capcom later confirmed as taken. The 11,774,247 figure is mailboxes and login metadata on a consumer account system. They are not the same unit, and the 2026 count is larger by two orders of magnitude on the customer side.

The Oversight Committee Heard This One on Day Two

The November 16, 2020 notice said Capcom would set up an advisory board on system security. That body now exists as the Information Technology Security Oversight Committee, an external group the company briefs on cyber risk. Investigators took this incident to that committee on October 20, the day after detection and the day before the police report.

Capcom’s governance pages also describe EDR on endpoints and an XDR-based security operations center watching networks, systems, and cloud. Those tools are the post-2020 stack. They did not stop an unnamed third party from reading 11,774,247 CAPCOM ID records and rewriting 196 passwords in 2026. The company now says it has identified the method and closed it, without saying what the method was.

Tsujimoto’s closing lines match the tone of 2020 almost beat for beat. Capcom takes the matter extremely seriously, will keep investigating, will try to stop a repeat, and will post new facts on its site if they appear. It again apologised to customers and other stakeholders. The script is stable. The layer that broke is new.

Japan’s Watchdog Had Warned Large Data Holders 12 Days Earlier

On October 7, 2026, Japan’s Personal Information Protection Commission issued an October 7 alert to large data holders after a run of big unauthorized-access leaks at other firms. The alert named no company. It told operators that hold a lot of personal data, especially in widely used services, to tighten technical controls and to check whether they still needed the data they were storing. Revised examples of required measures, including faster detection, were previewed ahead of a planned April 2027 guideline update.

Capcom’s CAPCOM ID file is exactly the kind of large, hard-to-leave consumer database that notice had in mind. Detection was October 19, twelve days after the watchdog’s alert. That is a calendar fact, not proof Capcom ignored the letter.

Japan’s 2022 privacy-law rules already required a preliminary report to the commission, promptly, with a working guide of about three to five days, plus a fuller report within 30 days, or 60 days when an attack may be involved. Leaks that affect more than 1,000 people, or that come from unauthorized access, trip those duties. Capcom’s report on October 21 came two days after it says it knew, inside the early window. Affected people must also be told; Capcom says that contact work is starting. A 2026 amendment will later add administrative fines for some violations, though not as a surcharge on attacker-caused breaches, and most of that package is not yet in force.

What Capcom ID Users Are Being Told

Registered email addresses can still be used. Capcom’s warning is about what arrives in them. Treat anything that looks like a Capcom password reset, a “verify your ID” link, or a file from a support desk as hostile until it is checked on a page the player typed, not clicked.

The company has opened dedicated channels and says it will mail affected customers itself. Type cid.capcom.com if the account needs a look. Do not reach it through a message.

SUPPORT LINES BY REGION

• Japan: Dedicated CAPCOM ID data-security line, toll-free 0120-801-271, 10:00 a.m. to 8:00 p.m. JST.
• North, Central, and South America: The Capcom USA customer inquiry form on the Capcom support site.
• Europe, the Middle East, and Africa: The same inquiry form, plus feedback@capcom.com.
• Asia outside Japan, and Oceania: info-asia@capcom.com.

If a player is in the 196, the password is already reset and the next login will force a new one. If a player is in the 43, date of birth, gender, region, and nickname are in the mixed file with the mail address. Everyone else in the 11,774,247 is on the phishing list. Reused passwords on other sites are the quiet risk Capcom cannot see.

Games, Cards, and What Stayed Off the Leak List

Capcom is repeating two assurances it also used in 2020: video games are still playable, and credit-card data was not in the reached set. The 2026 notice is narrower on money. It says card information was not among the affected information. It does not, in the October 22 text, retell the older line that Capcom stores no card numbers because a contractor handles checkout. Players who saved a card on a storefront still have that relationship with the store, not with this leak list.

What the attackers did get is enough to impersonate Capcom at scale. What they already did, on 196 accounts, is take the login. The Information Technology Security Oversight Committee now has a second incident on its docket, and the Personal Information Protection Commission has the preliminary report. Capcom says further facts will go up on its site. Until those arrive, the useful move for anyone with a CAPCOM ID is to ignore surprise links and wait for the company’s own mail, sent after this notice, not before it.