Capcom Security Breach Affects Over 11 Million Accounts

Japanese video game publisher Capcom has confirmed a major security breach affecting 11,774,247 customer accounts worldwide after an unauthorised third party accessed its Capcom ID systems on 19 October. The breach compromised metadata such as account creation timestamps, login frequencies, and client IP addresses, with a smaller subset suffering password alterations or personal profile exposure. For gamers in Malaysia and Southeast Asia using a Capcom ID to access online services, cross-play features, and community rewards, the incident presents heightened risks of targeted phishing campaigns, although no payment card data was exposed.

Key Facts

What Data Was Stolen in the Capcom ID Breach?

The Capcom ID breach compromised technical connection logs and account timestamps across 11,774,247 user profiles globally, rather than financial details. Specifically, the attacker accessed the date and time of account creation, last login timestamps, total login counts, and the client IP address associated with the account's last session, leaving critical banking records entirely untouched.

In addition to system-level metrics, smaller subsets of users suffered more severe exposure. Capcom confirmed that attackers forcibly changed passwords on 196 accounts, which have since been reset by the publisher. Furthermore, 43 accounts had personal identifiers exposed, encompassing dates of birth, gender, country or region, and user nicknames. No credit card information was exposed during the breach affecting 11.7 million Capcom ID accounts.

There is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties. If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.

Capcom official statement via Lowyat.NET

How Has Capcom Responded to the Cyberattack?

Capcom implemented emergency countermeasures to neutralise the exploit path and maintain normal operations while continuing its internal investigation into the incident. The publisher confirmed it identified and addressed the attack method, allowing gamers to use their Capcom ID without service interruption, though it has not publicly disclosed the technical vulnerability exploited.

To ensure legal compliance and oversight, the publisher formally reported the cyberattack to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The company indicated that ongoing findings will guide further security framework upgrades. Capcom has addressed the initial attack vector and reported the breach to Japanese law enforcement and data privacy regulators.

What It Means for Malaysian Buyers

Capcom ID services remain operational for Malaysian gamers, but users locally must be vigilant against targeted phishing scams resulting from exposed login records and IP addresses. The source does not outline specific impacts on local retail pricing, console hardware, or Malaysian distribution channels, confirming solely that worldwide accounts were accessed without payment card theft.

Because IP addresses and account metadata can assist bad actors in crafting convincing deceptive communications, Malaysian account holders should inspect all incoming Capcom-branded messages carefully. Unsolicited emails prompting password verifications or linking to external login pages must be avoided entirely. Malaysian Capcom ID holders face potential phishing risks despite Capcom confirming that payment information was not compromised.

Common Questions

Was any credit card or banking information stolen in the breach?

No credit card or payment information was exposed during the attack. The breach primarily affected account timestamps, login frequency tallies, and client IP addresses, leaving financial transaction databases uncompromised across all affected accounts.

Were user passwords compromised or altered during the attack?

A small subset of 196 accounts had their passwords altered by the attacker, but Capcom confirmed it has already reset those credentials. Most accounts only had metadata and last-login IP addresses accessed.

What should Capcom ID account holders do immediately?

Users should remain alert to unsolicited emails or messages claiming to represent Capcom, refraining from clicking external links or opening attachments. General account access remains operational under Capcom's implemented emergency response measures.

Sources and Methodology

Information in this dispatch is sourced directly from reporting by Lowyat.NET published on 24 October 2026, which references official incident disclosures provided by Capcom. All figures, including affected account totals and compromised data types, reflect verified claims published in the original reporting. No currency conversions were required as no financial transaction figures were detailed in the source.