What Capcom disclosed
CONFIRMED BY CAPCOM: The company announced unauthorized access to customer information connected with CAPCOM ID on October 22, 2026, then published additional findings on October 23. CAPCOM ID is its shared account for web services and some online games.
The notices do not describe an identical outcome for every record. The initial disclosure covers a broad information category, two smaller groups within it, and a later store-account finding within the password-change group.
How the affected records and accounts fit together
| Group | What Capcom reported |
|---|---|
| 11,774,247 records worldwide | Email addresses and system identifiers: account creation and last-login times, login counts and the client IP address at last login. |
| 43 records within that total | Additional profile fields: birth date, gender, country or region, and nickname. |
| 196 accounts within the broader affected group | Login passwords changed without authorization. Capcom said the affected passwords had been reset. |
| 19 of those 196 accounts, in Japan | Access to e-Capcom account pages exposed names and phonetic names, phone and postal details, addresses, gender, birth date, purchase/inquiry histories and saved address-book information. |
Password changes are a different finding from original-password exposure
Capcom confirmed unauthorized password changes on the 196 accounts. It did not confirm that passwords originally chosen by customers had been compromised. Both statements matter: the changes occurred, but they do not establish that every account in the larger record total was taken over.
Credit-card information was excluded from the affected information in both notices. The October 23 update says Capcom found no further information compromise resulting from the password changes on the other accounts. That narrower finding does not retract the broader October 22 disclosure.
The response timeline and what remained available
Capcom says it detected suspicious activity and confirmed unauthorized access on October 19. It established an incident-response headquarters on October 20 and reported the matter to police and Japan’s privacy regulator on October 21. Detection is not proof of the start time of every unauthorized action.
The October 22 notice said emergency measures had addressed the attack method and that CAPCOM ID services and games remained available. In the October 23 update, Capcom said its investigation into the scope of impact was complete, with monitoring continuing.
What users can do with Capcom’s advisory
Capcom warns that affected information could be used in emails, texts, calls or other communications impersonating the company or related parties. Its advice is to avoid opening links or attachments in suspicious communications.
The company says it will contact affected customers and lists regional support channels in both official notices. Use those notices or the linked customer inquiry form as the starting point for incident-related questions. The disclosures do not instruct every customer to replace a payment card or reset a password.
What the disclosures do not establish
The published notices do not give a unique-person total, a detailed technical intrusion window, verified customer loss figures or confirmation that every promised notification has arrived. A completed scope investigation also does not guarantee that nobody will later receive an impersonation message.
The useful distinction for users is which information and account category Capcom actually identifies. Read any contact about the incident against the dated official notices rather than treating the worldwide record figure as a uniform account-takeover claim.