On October 22, 2026, Capcom confirmed unauthorized access to its CAPCOM ID membership service. The company counted 11,774,247 records pairing email addresses with account metadata. Those details can make fraudulent messages more convincing, even though Capcom has not confirmed a leak of users’ original passwords or payment-card data.
What Capcom confirmed
Capcom says it detected suspicious activity on October 19 and confirmed unauthorized access that day. Its October 22 notice describes the affected information and the emergency measures it took. Services using CAPCOM ID remained available, and the investigation is ongoing.
The 11,774,247 figure covers email addresses and system identifiers, including account creation time, last login, login count and the IP address used for the last login.
Additional details for 43 accounts
For 43 of those records, the information also included date of birth, gender, country or region and nickname. Capcom says payment-card information was not affected. It has not confirmed that customer-set passwords were compromised.
Capcom did identify 196 accounts whose passwords had been changed without authorization. It says it reset those passwords and will notify affected customers. A password change does not by itself establish that other accounts were taken over.
Impersonation is the immediate concern
An email address combined with login details can help someone personalize a fake support message or account alert. Last-login and IP details could also make a phishing attempt seem more credible. That is a possible consequence of the exposed data, not evidence that such campaigns have already targeted players.
Do not follow a message link to “secure” your account or give a login code to someone who contacts you. Go directly to Capcom’s website or app to check alerts. If you reused your CAPCOM ID password, replace it on every service where it is identical.
Steps players can take
Check the inbox associated with CAPCOM ID and watch for notices from Capcom. Use a long, unique password and enable the sign-in protections the service offers. If you cannot access your account or notice profile changes, contact Capcom through its official channels.
People managing several accounts can separately record which credentials they checked, what they changed and which support requests remain open. A short record helps verify that a change was made on the right account and distinguish a real notice from an imitation.
The connection with Soclyde
An encrypted vault such as Soclyde can help you keep a distinct CAPCOM ID password and retrieve the access details needed for a review. It cannot prevent a breach at a third-party service or replace Capcom’s sign-in controls.
For teams sharing work accounts, see how Soclyde organizes access. Never store a one-time SMS or authenticator code in a password vault.
What to remember
Capcom described the access and affected data categories, but has not confirmed exposure of original passwords or payment-card data. Check notices in your account, replace reused secrets and ignore unexpected requests for codes. Our password security guide explains how to reduce credential reuse.
