Capcom ID Leak Hands Attackers a Ready Phishing Kit

Capcom said a third party used 19 hijacked CAPCOM ID logins to open Japanese store pages and take names, addresses, phone numbers and purchase histories. Those 19 shop accounts sat inside a larger dump: 11,774,247 email records and login logs taken from the company’s membership service on October 19, 2026.

The Resident Evil, Monster Hunter and Street Fighter publisher had already reset 196 passwords changed without permission. The October 23 follow-up shows those resets came after someone had already walked through the shop door on a slice of that set.

The 19 Store Logins Capcom Found Overnight

Capcom’s second notice, dated October 23, 2026, says a third party reached the mypage on e-Capcom for 19 accounts in Japan. All 19 were among the 196 CAPCOM ID logins whose passwords had been changed without the owner’s say-so.

The fields taken from those shop pages include names, phone numbers and purchase history, plus name in Japanese phonetic characters, postal code, address, gender, date of birth, e-Capcom inquiry history and the member address book. Capcom said it will contact those customers one by one.

Credit card data was not in the leak, Capcom said, and the remaining 177 password-changed accounts showed no further data taken from the password change itself. That is a closed claim about those 177 logins, not a claim that the rest of the 11,774,247 records are harmless.

e-Capcom is Capcom’s official Japanese online store. A CAPCOM ID is required to shop there. The same login that opens Street Fighter 6 or the Resident Evil Portal also opens a page that can hold a home address and a list of what someone bought.

The October 23 warning is wider than the first one. Capcom now tells customers to watch for short messages and phone calls that pretend to come from the company or its partners, not only for mail.

If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.

Capcom, October 22, 2026 notice

That line still stands. The new notice simply adds texts and calls to the same list, because 19 people now have phone numbers and home addresses in the stolen set.

What 11.77 Million Login Records Contain

The first public notice, dated October 22, put 11,774,247 email records worldwide in the dump. Beside each mailbox sat what Capcom calls system-specific identifier information: the date and time the account was created, the date and time of the last login, the number of logins, and the client IP address used at that last login.

Capcom has not confirmed that passwords customers set themselves were leaked. It has confirmed that passwords on 196 accounts were changed without authorization, and that those 196 have already been reset. For 43 records, the dump also held date of birth, gender, country or region, and nickname.

WHAT THE DUMP HOLDS

Last-login IP, last-login time and login count are enough to write a fake Capcom security mail that cites a time and a network. A message that says the company noticed a sign-in from that address, on that day, will look like it came from the help desk. The attacker does not need the user’s original password to send it.

Anyone who used the same mailbox on Steam, PlayStation, Xbox, a bank or a shop is the next stop. The 196 password changes already show the third party could write to accounts, not only read a table.

One Account Opens Street Fighter, Resident Evil and the Shop

CAPCOM ID is a free unified account for Capcom games and web services. Capcom’s own notice calls it the login registrants use to reach various web services, and the login needed to play certain Capcom games online. One mailbox, one password, several doors.

WHERE A CAPCOM ID OPENS A DOOR

• Resident Evil Portal: Stats, series news and account pages for the survival-horror line.
• Buckler’s Boot Camp: The Street Fighter 6 web service tied to the same login.
• Capcom Town: A Capcom web hub that also uses the ID.
• Monster Hunter Puzzles: Felyne Isles: The mobile puzzle game’s app login.
• e-Capcom: The Japanese shop whose mypage held names and order history for 19 people.

Street Fighter 6 and Exoprimal sit on the same account page as those sites. Capcom said play is unaffected and that CAPCOM ID services remain up after emergency measures. The blast radius is the shared login, not a game server.

The CAPCOM ID home page listed a system maintenance window for October 19, 2026, from 10:00 to 11:30 UTC. During that hour and a half, the portal, new sign-ups, logins, account edits, and logins to Resident Evil Portal, Buckler’s Boot Camp, Capcom Town and the Felyne Isles app were down. Capcom’s IR timeline says the company found traces of a break-in that same day and blocked the access at once. It did not say the posted window and the block were the same job.

From a Maintenance Window to the Osaka Police

Capcom’s October 22 notice walks through four days in the Osaka headquarters. President Haruhiro Tsujimoto’s name sits on the Japanese filing, under TSE Prime code 9697.

HOW THE BREACH UNFOLDED

1. October 19, 2026: Finds traces of suspected unauthorized access to CAPCOM ID, blocks that access, and confirms a break-in the same day. Starts emergency measures and work to identify the attack method. A posted maintenance window takes logins offline from 10:00 to 11:30 UTC.
2. October 20, 2026: Sets up an in-house response HQ. Confirms that some customer information leaked and that some passwords were changed without permission. Reports the incident to the Security Oversight Committee, Capcom’s external advisory body on security.
3. October 21, 2026: Reports the incident to police and to Japan’s Personal Information Protection Commission, then keeps watching the service while it maps the scope.
4. October 22, 2026: Publishes the first notice. Says emergency measures are done, the attack method has been identified and addressed, games still run, and a dedicated inquiry desk is open.
5. October 23, 2026: Publishes the second notice. Confirms the 19 e-Capcom mypage openings, says the check of the incident’s scope is complete, and keeps monitoring CAPCOM ID and related services.

Japanese privacy rules require firms to report a leak to the privacy commission when an attack may be involved or more than 1,000 people are hit. The first report is due promptly, a window the commission puts at about 3 to 5 days, with a fuller report later (30 days, or 60 days when wrongdoing such as an attack may be involved). Capcom’s police and commission report on October 21 came 2 days after the October 19 find, inside that first window.

Capcom did not describe the attack method in public. It said it had identified and addressed it. Games and CAPCOM ID services stay up, it said, and customers may keep using the email addresses on file.

The 2020 Ransomware Breach Was Smaller and Deeper

This is not Capcom’s first named break-in. On November 2, 2020, the company found trouble on its internal network, shut systems down, and later said a group calling itself Ragnar Locker had hit it with customized ransomware and demanded a ransom. It contacted the Osaka Prefectural Police then as well.

Capcom’s November 16, 2020 notice put the potential exposure at a maximum of about 350,000 items of personal information across help desks, a North American store list, an esports site, shareholders, former staff and job applicants. That was a different pile: names, addresses, phone numbers, some passport data, HR files, even photos of applicants, sitting on office systems rather than a public membership table.

By April 13, 2021, Capcom said it had verified personal information for 15,649 people as taken, a figure it had trimmed from an earlier verified count. The 350,000 figure was the outer potential in November 2020; 15,649 was the later verified total. Credit cards were kept off Capcom’s own systems then, too, because a third-party processor handled charges.

After that incident Capcom built a louder security story for investors. Its sustainability page, edited from the Integrated Report 2025, says the company runs a Security Oversight Committee, uses EDR on devices, and operates a SOC on top of XDR across networks, systems and cloud. It also says it has added generative AI to help spot threats. That committee was the body told about this CAPCOM ID incident on October 20, 2026.

The 2020 attack stole deeper files from a smaller set of people. The 2026 dump is thinner per person and far larger: more than 11 million mailboxes, each with a last-login IP and a last-login time. Scale is the change. The shared ID is why a password change on 196 of those logins could reach a shop page that holds a street address.

Treat Every Capcom Email as a Trap for Now

Capcom said customers can keep the addresses registered with CAPCOM ID. That is also the list a phisher now holds. A mail that quotes a last login, or a text that uses a real name and a real order, will look like the company’s own desk.

CAPCOM ID already offers two-factor authentication. An app code or a hardware key is the useful kind here. A code sent by text is a weaker fit for the 19 people whose phone numbers sat on those shop pages, and a weak fit for anyone whose number is easy to guess from other leaks.

WHAT TO DO WITH A CAPCOM-BRANDED MESSAGE

• Skip the link: Do not open URLs or attachments in mail, texts or DMs that claim to be Capcom, e-Capcom, Resident Evil Portal or Street Fighter support.
• Use the known page: Type cid.capcom.com yourself, or use the game’s own account screen, if you need to change a password or check a login.
• Turn on app 2FA: Set two-factor authentication on CAPCOM ID and on Steam, PlayStation, Xbox and any shop that shares the same mailbox.
• Call the desk Capcom published: In Japan, the CAPCOM ID incident line is 0120-801-271, 10:00 a.m. to 8:00 p.m. JST. Americas and EMEA go through Capcom’s support form; EMEA also lists feedback@capcom.com, and Asia excluding Japan lists info-asia@capcom.com.

Capcom said it will write to the 19 shoppers whose mypages were opened. The other 11,774,247 records stay a phishing list until those mailboxes are treated as public. The company said it takes the matter extremely seriously and will put recurrence measures in place from the inquiry. The next mail that looks like Capcom is the part of this leak that still has work to do.