You Have 5 Days: Inside the Capcom Breach (11.7M Accounts)

You run security at one of the biggest game companies in the world. Today, you find something in the logs that should not be there. Someone has been inside your player accounts. Millions of them. You have five days before the whole story is out.

That's not a story I made up. It's what Capcom, the Street Fighter company, went through between October 19 and 23, 2026. I made a video that plays it out day by day. This article puts the two official notices next to each other, with every field that leaked, how many accounts each one touched, and how this compares with the last time Capcom was hit, in 2020.

I also made a video of this.

The short version

• On October 19, Capcom found and blocked unauthorized access to CAPCOM ID, its account service for games and websites. Four days later, the scope investigation was finished.
• Email addresses and login data for 11,774,247 records leaked worldwide. No passwords set by players were confirmed leaked, and no card data.
• But the attacker changed the passwords of 196 accounts. Through 19 of them, the attacker got into e-Capcom, Capcom's online store in Japan, and saw names, phone numbers, home addresses and purchase history.
• Capcom has not said how the attacker got in or how the passwords were changed.
• The biggest risk for most players is not the leak itself. It is the fake "Capcom security" email that is now very easy to write.
• In 2020, Capcom was hit by ransomware through an old backup VPN device. That time the full investigation took about five months.

Day 1 to Day 5, from Capcom's notices

Day 1, October 19. Capcom detected suspicious activity on CAPCOM ID and started blocking the access right away. The same day, it confirmed that unauthorized access had happened, and started finding and closing the method of attack.

Day 2, October 20. It set up an internal incident response headquarters. It confirmed that customer information had been accessed, and that the passwords of a limited number of accounts had been changed without permission. That same day, it reported to its Information Technology Security Oversight Committee, an outside advisory body. Keep that committee in mind. It exists because of 2020.

Day 3, October 21. It reported to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission, the privacy regulator.

Day 4, October 22. It went public with the first notice: 11,774,247 records.

Day 5, October 23. The second notice traced where the 196 hijacked accounts led. For 19 of them, the attacker had opened the account pages of e-Capcom. Capcom said the investigation into the scope of the impact was complete.

What exactly leaked

The video rounds this to "your email." The notices are more precise.

Group	How many	What leaked
Everyone affected	11,774,247 records, worldwide	Email address, when the account was created, when it last logged in, how many times it logged in, the IP address used at the last login
Part of the above	43 records	Also date of birth, gender, country or region, and nickname
Part of the above	196 accounts	The attacker changed the login password. Capcom has since reset them
Part of the 196	19 records, all in Japan	e-Capcom: name, name in Japanese phonetic characters, phone number, postal code, address, gender, date of birth, purchase history, customer support history, and the saved address book

Three things the notices also say:

• Capcom has not confirmed that any password a player set was compromised. The 196 were passwords changed by the attacker, not stolen.
• Credit card information was not included.
• CAPCOM ID kept working, and the games were not affected. Players could keep using the same email address.

What the notices don't say: how the attacker got in, and how the 196 passwords were changed. Capcom says it has "identified and addressed" the method. It doesn't describe it, so I won't guess.

Why "just an email" is enough

Now switch sides. If you play Capcom games, you're not the security lead. You're one of the 11.7 million.

It's easy to think: it's just my email. Who cares? But look at the table again. The attacker knows your email, that you have a CAPCOM ID, when you made it, when you last logged in, and how often you play.

That's everything needed to write a very convincing message. Something like: "Your CAPCOM ID was affected by the recent incident. Your last login was on [the real date]. Click here to secure your account." A real date in a fake email is very persuasive.

Capcom's own warning covers exactly this: fraudulent emails, texts and even phone calls that impersonate Capcom using the leaked information.

The real email and the fake one will look the same

Here's the hard part. Capcom said it would contact affected customers. When that real email arrives, it will say almost the same thing as the fake one. Same logo, same topic, same urgency.

You can't tell them apart by looking. So don't try. Never use the link in the message. Open Capcom's site yourself, by typing the address. If the message is real, you'll find the same information there.

The 19 people whose e-Capcom data leaked have a harder problem. Someone who knows your name, phone number, home address and what you bought can call you and sound exactly like customer support. Knowing your details doesn't make them real.

This is not the first time: 2020

In November 2020, Capcom was hit by ransomware. Its final report, published on April 13, 2021, explains how.

• In October 2020, attackers got into the network through an old backup VPN device at Capcom's U.S. subsidiary.
• Capcom had already switched to new VPN devices. But because of the strain COVID put on its network in California, it kept one old device as an emergency backup. That was the one attacked.
• From there, the attackers reached devices in both the U.S. and Japan offices.
• On November 1, 2020, from about 11 pm Japan time, ransomware encrypted files. A message from a group calling itself Ragnar Locker was left on the infected devices.
• Capcom was in the middle of adding round the clock monitoring (a SOC service) and endpoint detection (EDR), but they were not yet in place.
• Personal data of 15,649 people was confirmed stolen.
• Capcom did not negotiate with the attackers and never contacted them.

The thing nobody was looking at. That's usually the way in.

And the Oversight Committee that Capcom reported to on Day 2 this time? It was set up in January 2021, as part of the response to that attack.

2020 and 2026 side by side

	2020	2026
What happened	Ransomware inside the company network	Unauthorized access to the player account service
How they got in	Old backup VPN device at the U.S. subsidiary	Not disclosed
Detected	November 2, 2020	October 19, 2026
First public notice	November 4, 2020 (2 days later)	October 22, 2026 (3 days later)
Investigation finished	April 13, 2021 (about 5 months)	Scope finished October 23, 2026 (4 days)
Confirmed leaked	Personal data of 15,649 people	11,774,247 records (email and login data), 19 with home address
Card data	Not included	Not included

The speed is very different this time. The size is very different too.

Other Japanese game companies

So if Capcom got hit, what about the others? Here's what has been made public.

• Bandai Namco Experience, October 9, 2026: the Wangan Midnight arcade portal. Member data of 1,694 people may have leaked, through "Commune," a community system run for them by an outside company. The data: email address, nickname, account name, self introduction, profile fields, group, points and last active time.
• Nintendo, 2020: about 160,000 accounts were logged into by someone else, using passwords leaked from other services. That later grew to around 300,000.
• KADOKAWA, 2024: the parent company of FromSoftware, the Elden Ring studio, was hit by ransomware. Personal data of 254,241 people leaked.

Same month as Capcom, different door: Bandai Namco's leak came through a vendor.

Are they just not telling us?

A fair question: what about the ones we haven't heard about?

Here's how it works in Japan. Since 2022, a company has to report to the Personal Information Protection Commission when a leak affects more than 1,000 people, or when it may have been done on purpose, as an attack is. The regulator's page says to report promptly once a leak is found, and, when it may have been deliberate, within 60 days of finding it. The people affected must be told too.

So a big company can't legally keep a hack like this quiet. The real gap is time. In Capcom's 2020 case, the attackers got in during October, and nobody noticed until the ransomware went off on November 1.

So the question isn't "are they hiding it." It's "do they know yet." You can't wait for that answer.

Four things to do today

If you have a CAPCOM ID, this takes about five minutes.

1. Don't click any link in an email or text about this breach. Go to Capcom's site by typing the address yourself.
2. Change your CAPCOM ID password, and make sure you don't use it anywhere else.
3. Turn on two-step verification on your email account. Your email is what leaked. It's also the key that resets everything else.
4. If you've ever shopped on e-Capcom, be careful with calls or texts that already know your name and address.

If you want to ask Capcom directly, its notices list a toll-free support line in Japan (0120-801-271, 10 am to 8 pm Japan time) and an online form for the Americas and for Europe, the Middle East and Africa. Find them from Capcom's own site, not from a link in a message.

What I take from this

My company has run an online service in Japan for 22 years. And honestly, I'll give Capcom credit here. They found it, cut it off the same day, went public in three days, and finished the scope in five. Compared with five months in 2020, that's fast.

But the lesson for all of us is this. One login now opens many doors. Your games, your store account, your address. 196 hijacked logins became 19 home addresses. When one door opens, the others are right behind it.

Did you get an email from Capcom about this? Or a suspicious one pretending to be Capcom? Tell me in the comments on the video. I read every one, and I'll reply.

Sources: Capcom, "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access" (October 22, 2026) and its update (October 23, 2026); Capcom, "4th Update Regarding Data Security Incident Due to Unauthorized Access: Investigation Results" (April 13, 2021); Bandai Namco Experience, Wangan Midnight Arcade Portal notice (October 9, 2026, updated October 14, Japanese); Personal Information Protection Commission, breach reporting page (Japanese). Read on November 2, 2026. Nintendo and KADOKAWA figures are from those companies' past public reports as used in the video.