Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer Records Exposed

Capcom has announced plans to notify customers after unauthorized access to its CAPCOM ID service affected 11,774,247 records worldwide.

The Japanese game publisher disclosed the incident on October 22, 2026, saying the exposed information included email addresses and details of account activity.

Attackers also changed passwords on 196 accounts without permission. Capcom has reset those passwords, while its games and online services remain available.

Capcom Confirms Records Exposed

According to the company’s official security notice, CAPCOM ID is a shared account service used across its websites and required for online access to certain games.

The company apologized to customers and said it had completed emergency response measures. Its investigation into the full impact remains ongoing.

The affected records contained registered email addresses, account creation dates and times, last login dates and times, login counts, and the IP address used during the most recent login. These details reveal account activity, although the notice does not establish that every exposed record represents a separate person.

A smaller group of 43 records also included dates of birth, gender, country or region, and nicknames. These records are part of the overall total, not a separate set of affected accounts. The affected data did not include credit card information.

Capcom has not confirmed any compromise of customers’ originally chosen passwords. However, unauthorized password changes affecting 196 accounts show the incident involved changes to some accounts, not just access to stored information. The company has not publicly explained how it made those changes.

Capcom detected suspicious activity on October 19 and immediately began blocking access while investigating. It confirmed unauthorized access that day and introduced emergency measures.

On October 20, the company established an internal incident response headquarters and confirmed that customer information had been affected.

Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21. It says investigators identified and addressed the attack method, but the public notice does not name a vulnerability, describe the entry point, or identify an attacker.

That leaves important technical questions unanswered. The disclosure doesn’t say whether attackers used stolen credentials, exploited a software flaw, or reached the service another way.

Capcom warned that affected information could support fraudulent emails or messages pretending to come from the company or related parties. Customers should avoid links and attachments in suspicious messages.

The warning describes a possible follow-up threat, not a confirmed phishing campaign linked to this breach. Related reporting on malware affecting Japanese cloud servers highlights similar warnings about fake support messages.

Coverage of QR-code phishing emails also shows how criminals use deceptive messages to steal login details. Neither report links to Capcom.

Capcom says registered email addresses can still be used. Affected customers will receive notifications, and dedicated regional support channels are available. The company plans further security improvements based on its findings and will publish additional information through official channels as required.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer Records Exposed appeared first on Cyber Security News.