If you ever made a Capcom ID so you could play something like Street Fighter 6 online or sign in to a Capcom website, today's news probably hit your stomach before it hit your head. On Thursday, Oct. 22, 2026, Capcom told the world that a third party got into its account service and reached 11,774,247 records.
I spent the day reading the coverage, and the short version is calmer than the headline number. Capcom says credit card information was not involved, and says it has found no evidence that the passwords customers set were leaked. The longer version is that a list of 11.7 million email addresses is exactly what scammers want, and that's where I'd put my attention.
How many Capcom ID accounts were affected? The three numbers that matter
Breach stories rise and fall on their numbers, so here are the only three Capcom gave, each with a plain-English translation. The big one gets the headline. The two small ones are where the real harm sits.
This is Capcom's count of affected CAPCOM ID records. Outlets often call them accounts, but Capcom's wording, as CyberInsider and mxdwn relay it, is records, and it gave one worldwide total with no breakdown by country.
Someone changed the login passwords on 196 accounts, and Capcom has reset them. That's about 1 in 60,000 of the records. Two outlets, Windows Central and Windows Report, say 193. Most others, including CyberInsider and mxdwn, say 196, so that's the number I'm using.
For 43 records the exposure went further: date of birth, gender, country or region, and nickname. That's about 1 in 274,000 of the records.
My read: for almost everyone with a CAPCOM ID, "affected" means an email address and some login history. For 43 records it's more personal. For 196 accounts, someone actually reached in and changed the lock. Those are three very different levels of affected, and the headline number only describes the first one.
What data did the Capcom ID breach expose? The exposure receipt
Here's everything the coverage says was in the records, laid out like a receipt. I sorted it by how much it matters, not by how Capcom's list happens to read.
The line that bothers me most isn't the email address. It's the last login time and the IP address next to it. An IP address usually points to a general area, not your front door, and on its own it's not much. But a scammer who knows roughly when you last logged in has material to make a fake message sound less generic. That's a risk, not a certainty, and I'd rather name it plainly than wave it away.
When did Capcom find the breach? What happened, day by day
The timeline below comes from CyberInsider's and esports.gg's accounts of Capcom's notice. Four calendar days, start to finish.
Capcom spots it and shuts the door
The company detects signs of unauthorized access to CAPCOM ID, blocks the access, starts investigating and confirms the intrusion the same day. Emergency countermeasures follow.
A response headquarters, and the first confirmation of a leak
Capcom sets up an internal response headquarters. Its investigation confirms that customer information leaked and that passwords were changed without authorization. It also notifies an external advisory body.
Police and the privacy regulator are told
Capcom reports the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.
The public notice and apology
Capcom publishes the numbers and apologizes. It says services that use CAPCOM ID remain available and that gameplay isn't affected.
Three days from spotting the intrusion to a public apology is quick, and I'd rather hear exact numbers early than vague ones late. What I can't judge is how long the intruder was inside before Oct. 19. According to esports.gg, the announcement doesn't say when the intrusion began.
How do I know if my Capcom ID was affected? Three kinds of Capcom players
I didn't find a public lookup tool in the coverage I read. CyberInsider reports that Capcom is contacting affected customers individually, but I wouldn't sit and wait for that email. Here's how I'd sort yourself.
You made a CAPCOM ID
Assume your email address is in the records and act on that. Do the five-minute plan below. It costs you a few minutes and covers you whether or not you were one of the 11.7 million.
You play Capcom games but never made a CAPCOM ID
The notice is about CAPCOM ID records. Nothing in the coverage I read says Steam, PlayStation, Xbox or Nintendo accounts were involved, so I'd treat those as outside this incident unless Capcom says otherwise. I can't rule out that you're in the data, because I can't see it.
You signed up years ago and forgot
This is the group I'd worry about most, because a forgotten account is one nobody is watching. Try searching your inbox for "CAPCOM ID" to see whether you ever registered. Read the old message if you find one, but don't click links in it. If you need the account, go to Capcom's site yourself.
Could Capcom ID breach emails be phishing? My five-second test
Capcom's own warning, as outlets relayed it, is that the leaked information could be used to send fake emails posing as Capcom or its partners, and that you shouldn't open links or attachments in messages that look suspicious. I agree, and I'd go one step further: the emails that follow a breach matter more than the breach itself, because you can reset a password but you can't reset an email address.
Gaming news is a magnet for scams. I made a similar point in my piece on the GTA 6 leak threat and the fake downloads around it. So here's a test I'd run on any message that claims to be from Capcom. It takes five seconds. Count your yeses.
Does it ask you to click or open something to "verify" or "secure" your account?
Legitimate companies do send links sometimes, but this is the single most common shape of a phishing message.
Does it set a deadline or a threat?
"Your account will be closed in 24 hours" is pressure, and pressure is the point.
Does it ask for a password, a code or payment details?
CyberInsider's report advises treating unsolicited requests for login credentials or payment details with caution. I'd go further: no legitimate sender needs your password in an email.
Does the sender or link look even slightly off from the Capcom sites you normally use?
On a phone, press and hold a link to preview where it goes before you tap. A look-alike address is a yes.
Does it quote details about you to prove it's real?
A message that knows your sign-up date or your last login is not proof it's genuine. After this breach, that information is exactly what a fake would borrow.
What should I do after the Capcom ID breach? Your five-minute plan
Capcom hasn't told everyone to change their password, in the coverage I read. These steps are my cheap-insurance picks, and I've marked which ones come from Capcom.
Don't click anything in an email about the breach
Go to CAPCOM ID directly, in your browser or app. Capcom's warning, as outlets relayed it, is to refrain from opening links or attachments in suspicious messages, and CyberInsider adds that customers should access CAPCOM ID directly.
Capcom's warning, plus standard practiceChange your CAPCOM ID password to one you use nowhere else
If you reused that password on any other site, change it there too. Capcom says it found no evidence your password leaked, so this isn't an emergency. It's two minutes of insurance against the 196-account problem and against reuse.
My pickProtect the email account itself
Your email address is where password resets arrive. If someone gets into your email, every account tied to it is in play. Make that password unique and turn on two-step verification if your provider offers it.
My pickTreat unexpected security notices as a prompt to check, not to click
Capcom found 196 accounts with unauthorized password changes. If you get a password-change or security notice you didn't ask for, go to CAPCOM ID directly and look.
My readIf you need help, use the contact options on Capcom's own site
Coverage reports a toll-free line in Japan, an inquiry form for the Americas and for Europe, the Middle East and Africa, and an email address for the rest of Asia and Oceania. Reach them through Capcom's site, not through a link in an email.
As reported by outletsWho hacked Capcom, and how? Where the notice goes quiet
A breach notice is a snapshot of what a company is ready to say. Here's what the coverage says it left out, and I think each gap matters.
For context, this isn't Capcom's first incident. In November 2020 the company disclosed a ransomware attack on its network and detailed what was compromised in its own notices. That was a different kind of attack on a different system, so I wouldn't draw a straight line between the two. I'd just note that the company has been through this before and has a template for talking about it.
Is the Capcom ID breach serious? My risk meters and verdict
These meters are my judgment, not measured data. Each one says where the rating comes from.
Capcom says it found no evidence that customer-set passwords leaked.
Based on Capcom's statementCapcom says credit card information was not involved.
Based on Capcom's statement196 accounts did have their passwords changed without permission, so takeovers happened. Reusing a password across sites raises your exposure to this kind of attack.
My readEmail addresses can't be reset like passwords, and Capcom itself warned about fake emails. This is the risk I'd rank highest.
My readQuick answers
Was Capcom hacked?
Capcom says a third party gained unauthorized access to CAPCOM ID, its shared account service. It detected signs of it on Oct. 19, 2026 and announced the incident on Oct. 22.
How many Capcom ID accounts were affected?
Capcom counted 11,774,247 records worldwide. Many outlets call them accounts. Capcom gave a single worldwide total and no breakdown by country.
Were Capcom ID passwords leaked?
Capcom says it found no evidence that passwords customers set were leaked. It did find 196 accounts whose passwords were changed without authorization, and it has reset them. Two outlets report 193 instead of 196.
Were credit card numbers exposed in the Capcom breach?
Capcom says credit card information was not involved.
What information was exposed in the Capcom ID breach?
Email addresses, account creation date and time, last login date and time, number of logins and the IP address used at the last login. For 43 records, also date of birth, gender, country or region, and nickname.
Do I need to change my Capcom ID password?
In the coverage I read, Capcom didn't order a password change for everyone. I'd change it anyway if you reused it anywhere, because it takes two minutes and the cost of being wrong is higher.
How can I check if my Capcom account was affected?
I didn't find a public lookup tool. CyberInsider reports Capcom is contacting affected customers individually. If you have a CAPCOM ID, I'd assume your email address is in the records.
Can I still play Capcom games after the breach?
Capcom says services that use CAPCOM ID remain available and that gameplay isn't affected.
What should I do if I get an email claiming to be from Capcom?
Don't click links or open attachments. Capcom warned that the leaked data could be used for fake emails and told customers not to open links or attachments in suspicious messages. Go to CAPCOM ID directly instead. Use my five-second test above if you're unsure.
Does this affect my Steam, PlayStation, Xbox or Nintendo account?
Nothing in the coverage I read says so. The notice is about CAPCOM ID records.
Did the Capcom breach only affect Japan?
Capcom gave a worldwide total with no regional breakdown. Some outlets speculated about Japan, but Capcom hasn't confirmed that.
