Capcom Data Breach: 11.77M CAPCOM ID Records [2026] - shattered.io

The Japanese gaming company revealed that the breach involved two categories of data: email-address records and system-specific identifier information used internally to distinguish accounts. Notably, Capcom confirmed that credit-card information was not affected, though the company acknowledged that 196 accounts had their passwords changed without authorization, prompting Capcom to reset those passwords.

The scale of the breach is substantial, affecting approximately 11.77 million records worldwide. While this represents a significant exposure, the unauthorized password changes affected only about 0.0017% of the compromised records, or roughly one account in 60,000. This suggests the password-changing activity was targeted rather than a mass takeover.

Phishing Risk

Despite not including passwords in the confirmed accessed data, Capcom explicitly warned customers that the exposed information could be misused in fraudulent emails or other communications impersonating the company or related parties. The company advised customers: "If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files."

Media Coverage

Major gaming outlets including IGN, Automaton, Video Games Chronicle, Rock Paper Shotgun, GamingBolt, and Escudo Digital all reported the breach within hours, consistently highlighting the 11.77 million figure and the phishing warning. While most outlets summarized Capcom's notice, some emphasized different aspects—Rock Paper Shotgun focused on Capcom's warning about phishing emails, while Video Games Chronicle stressed that credit-card details remained unaffected.

What Players Should Do

Security experts advise CAPCOM ID users to be vigilant for phishing attempts that may use the breach as a pretext. Players should avoid clicking on links in emails claiming to be from Capcom and instead navigate to official websites directly. Additionally, since 196 passwords were compromised, users should consider changing their CAPCOM ID password, especially if they reuse it on other platforms.

The breach comes during a year when gaming and consumer app breaches have become increasingly common, with a similar magnitude breach affecting Burger King Japan's app earlier, exposing 11.18 million records. This pattern highlights the growing security challenges facing digital services that handle large volumes of customer data.