MediumII Cyber Warfare & Critical Infrastructure22 October 2026, Thursday
Capcom account system breached, exposing 11.7 million email addresses
Japanese games company Capcom confirmed on 22 October that its CAPCOM ID account system had been accessed without authorisation, exposing 11,774,247 email addresses. There is no evidence that passwords or card details leaked; the attacker changed the passwords of 196 accounts.
According to the company notice reported by Notebookcheck, Capcom spotted suspicious activity on 19 October, set up a task force on 20 October and reported the incident to the police and the Personal Information Protection Commission on 21 October. The exposed data covers 4 items: account creation date, last login time, login count and the IP address of the last login. For 43 accounts, date of birth, gender, country and nickname also leaked. CAPCOM ID is the shared account system used across the company's web services and some of its online games.
BleepingComputer reported on 22 October that the company says it has identified how the attacker got in but has given no details; when the breach began and who was behind it remain unclear. Capcom was hit by the Ragnar Locker ransomware group in November 2020, which claimed to have stolen 1 TB of data. In April 2021 the company said that attack came in through an old VPN device; any link to the 2026 breach is unknown. Given the number of accounts, Capcom will notify users in stages, and as of 22 October it is keeping its online services running.
Talay assessment
Bottom line
The leak did not touch payment data, but 11.7 million email addresses hand phishers a ready-made target list for impersonating the company. Until the entry method and the culprit are disclosed, it is unclear whether the incident is heading towards extortion or a data sale. As unauthorised-access notices pile up at large Japanese companies, the case sharpens the debate over how binding personal-data oversight really is.
Likely effects
- Phishing riskNegativeWeeks
Exposed emails and last-login IP addresses make it easier to run targeted phishing campaigns posing as Capcom or its partners.
- Japanese data regulationUncertain1–6 months
The notification to the Personal Information Protection Commission opens a new case that tests its enforcement powers over large-scale leaks.
Possibilities, ranked
- 1Phishing wave, little further leakage55%
The leaked addresses are used in phishing emails posing as Capcom, and no further data category emerges.
Watch: Warnings from the company or security firms about phishing emails impersonating Capcom
- 2Culprit surfaces with extortion or a sale30%
A group lists the data on a leak site or demands payment from the company.
Watch: Capcom data being advertised on a leak site or forum
- 3Scope widens15%
As the investigation proceeds, password hashes or payment data join the list of affected items.
Watch: Capcom widening the affected data categories in a further notice
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Emails exposed▼ 11.77 million
- Accounts with changed passwords▼ 196
- Accounts with extra data leaked▼ 43