Hackers took email addresses and login records from the Resident Evil publisher's account system. Most passwords stayed safe, but the phishing risk is real.

If you have ever created an account to play a Capcom game online, your email address may be on a list now circulating outside the company. Capcom, the Japanese publisher behind Resident Evil, Monster Hunter, Street Fighter and Mega Man, has confirmed that hackers broke into CAPCOM ID — its shared account system for web services and some online games — and took records belonging to more than 11.7 million accounts. Here is what was taken, who is affected, and what players should do about it.

What happened

Capcom says it detected suspicious activity and confirmed unauthorized access on 19 October. An investigation was launched immediately, and by the following day it was clear that customer information had been compromised. On 21 October, the company reported the incident to the police and to Japan's Personal Information Protection Commission, and it made the breach public in an alert the next day.

One thing Capcom has not shared is how the attackers got in. The company says it identified the intrusion method during its investigation and put security measures in place to prevent a repeat, but it has released no details about the original entry point. It also has not said when the intrusion actually began — 19 October is the day it was spotted, not necessarily the day it started.

What data was exposed

For the great majority of the 11.7 million accounts, the haul was email addresses plus account metadata: the date the account was created, the time of its last login, the total number of logins, and the IP address used at that last sign-in. That is less dangerous than a password leak, but it is far from harmless. An email address paired with your last login time and IP address tells an attacker that you are a real, active Capcom customer — exactly the starting point needed for a convincing phishing email.

A small group was hit harder. For 43 accounts, the exposed data also included dates of birth, gender, nicknames and countries. And Capcom has been clear about the good news: passwords for all other registered members were not exposed, and credit card information was not affected.

196 players locked out of their own accounts

The strangest part of the breach concerns 196 accounts. On those, the hackers changed the CAPCOM ID login passwords — a move BleepingComputer describes as an attempt to lock the owners out of their own accounts. Why lock ordinary players out? Possibly to slow down victims while accounts were abused, or simply to cause disruption. Capcom says it has reset those passwords, so the owners should be able to get back in.

If you find you suddenly cannot sign in to your Capcom account, this may be why — use the official password-reset flow on Capcom's own site, not a link from any email.

Not Capcom's first breach

Long-time readers may remember that Capcom has been here before. In November 2020, the Ragnar Locker ransomware gang attacked the company and claimed to have stolen 1 TB of data; Capcom later warned that up to 390,000 people could be affected. In April 2021, it disclosed that the attackers in that incident had gained access through an old VPN device that had been left in service.

This new incident looks different — no ransomware group has claimed it, and Capcom describes a targeted break-in at its account system rather than a network-wide attack. But it shows that the account database of a major games publisher remains a prize worth chasing.

Where things stand

Capcom says its online services remain unaffected and games continue to run. Because of the sheer number of accounts involved, the company will notify affected customers in stages rather than all at once, and it has set up region-specific support channels for players to submit requests. It has also warned users to stay alert for unsolicited emails asking for personal information or carrying links and attachments — advice worth taking seriously in the weeks after any breach this size.

What this means for you

• Treat Capcom-themed email as suspect. A message that knows you are a Capcom player and roughly when you last played is not proof it is genuine. Go to Capcom's official site or app yourself instead of clicking links.
• Change your password if you reused it. Capcom says passwords were not exposed, but if your CAPCOM ID password matches the one you use anywhere else, changing it is cheap insurance.
• Turn on extra sign-in security where offered, and keep an eye on your account for logins you do not recognise.
• Watch for the 196-account trick in reverse. If you are locked out, recover the account only through Capcom's official channels — scammers love sending fake "your account was locked" emails after news like this.

Sources

BleepingComputer, "Capcom confirms data breach affecting 11.7 million accounts," 22 October 2026 — https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/

Related reading: Was Your Email in a Data Breach? How to Check Safely · Your Data Was in a Breach. Do These 7 Things Today