Capcom Data Breach: What to Do If You Have a CAPCOM ID

Last checked: Oct 22, 2026. Based on Capcom's official press release.

On October 22, 2026, Capcom disclosed that a third party gained unauthorized access to CAPCOM ID, the account system needed to play certain Capcom games online. The breach exposed 11,774,247 CAPCOM ID records worldwide.

Capcom detected the unauthorized access on October 19, 2026, immediately began blocking the access, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21. Here's what was exposed, what wasn't, and what you should do if you have a CAPCOM ID.

#What is CAPCOM ID?

CAPCOM ID is Capcom's account system needed to play certain Capcom games online. According to Video Games Chronicle, the service is required for games including Street Fighter 6. GamesRadar+ reports it's the platform needed to play Street Fighter, Monster Hunter, and Resident Evil online.

If you've played any of these games online or created a Capcom account for multiplayer, you likely have a CAPCOM ID.

#What data was exposed

According to Capcom's October 22, 2026 press release, the breach exposed the following information:

What was not involved:

• No credit card information was accessed
• Capcom has not confirmed that customer-set passwords were leaked
• The games themselves still work

The 196 accounts that had passwords changed without permission have been reset by Capcom. Capcom says it will notify affected customers going forward.

#Why this breach matters

11.7 million email records means scammers now have a list of up to 11.7 million email records tied to Capcom accounts. Combined with login times and IP addresses, this data can be used to craft convincing phishing attacks.

The bigger concern isn't the data itself. It's what comes next: phishing emails that look like they're from Capcom.

#The phishing risk: fake Capcom emails using your real address

Capcom warned in its press release that the exposed data "could be misused to send fraudulent emails or other communications impersonating Capcom or related parties."

Here's why that matters. After a breach like this, scammers send phishing emails that look official:

Red flags to watch for:

• "Your CAPCOM ID has been compromised. Click here to verify."
• "Update your account security now to keep playing."
• Emails asking you to re-enter your password or payment information.
• Messages with urgent language and links to sites that look like Capcom's but aren't.

The trick: The email comes to your real address, the one you used for CAPCOM ID, so it feels legitimate. But the link goes to a fake site designed to steal your password or payment details.

The rule: Never click links in unsolicited emails claiming to be from Capcom. Go to Capcom's official website yourself (capcom.com or cid.capcom.com) by typing the URL directly into your browser.

#What to do if you have a CAPCOM ID

#1. Change your CAPCOM ID password now

Even though Capcom hasn't confirmed customer-set passwords were leaked, it's time to change yours:

1. Go to cid.capcom.com directly (type the URL yourself, don't click a link).
2. Log in with your current credentials.
3. Go to your account settings and change your password.
4. Use a long, unique password you don't use anywhere else.
5. Write it down or save it in a password manager.

Don't reuse this password. If you used your old CAPCOM ID password on other sites (your email, shopping accounts, streaming services), change it on those sites too. Password reuse is how one breach unlocks other accounts.

#2. Don't click links in emails claiming to be from Capcom

For the next few weeks, ignore any email that says it's from Capcom, especially if it asks you to:

• Click a link to "verify your account"
• Update your security settings
• Re-enter your password
• Confirm your email address
• Download an attachment

If you're not sure whether a message is real, go to Capcom's site yourself. Don't use the link in the email.

#3. Watch for texts and messages too

Phishing doesn't only happen over email. Scammers may also contact you via:

• Text messages (SMS)
• Discord or gaming community DMs
• Social media messages

The same rule applies: don't click links. If someone contacts you claiming to be Capcom support, verify it through official channels before responding.

#4. Check your account for unusual activity

Log in to your CAPCOM ID (by going to cid.capcom.com yourself) and review:

• Recent login activity or security alerts
• Any changes to your profile, email address, or linked accounts
• Payment methods or subscriptions you don't recognize

If you see anything suspicious, change your password immediately and contact Capcom support through their official website.

#5. Turn on two-factor authentication if available

If Capcom offers two-factor authentication (2FA) for CAPCOM ID, turn it on. This adds a second layer of security beyond your password, usually a code sent to your phone or generated by an authenticator app.

Check your account security settings on cid.capcom.com to see if 2FA is available for your account.

#6. Reduce your exposure: remove your data from people-search sites

Here's the connection most people miss. Data from breaches, old accounts, and public records eventually ends up with data brokers, and people-search sites compile it into profiles that list your email, phone number, and address in one place.

When your email is in a breach, scammers can search for it on people-search sites to find your other contact details and build more convincing phishing messages.

UndoLeak erases your data from data brokers and keeps it off. Fewer public listings mean fewer ways scammers can reach you. Run our free people-search check to see where your email and phone number are listed, then opt out.

#A fictional example

Marcus Chen, a software developer in San Francisco, has played Street Fighter 6 online since its release. On October 22, he saw news of the Capcom breach and realized his CAPCOM ID email address was likely in the dataset.

He:

1. Went directly to cid.capcom.com and changed his password to a new, unique one saved in his password manager.
2. Checked whether he'd reused that password anywhere else. He had, on an old forum account and a shopping site. He changed both.
3. Added a note in his email filters to watch for messages claiming to be from Capcom over the next few weeks.
4. Ran a people-search check and found his email listed on two sites. He opted out of both.

Three days later, Marcus got an email: "Your CAPCOM ID was accessed from an unusual location. Verify your account now: [link]." The sender address looked close to Capcom's, but not exact. Marcus deleted it without clicking and logged in to cid.capcom.com directly. There were no security alerts on his account. The email was fake.

#Timeline

#How gaming account breaches happen

Gaming platforms are frequent targets because they hold verified email addresses for millions of users who care deeply about their accounts and will respond quickly to urgent-sounding security messages.

Common causes of gaming breaches include:

Capcom did not disclose the cause of this breach or how the attacker gained access. The company's press release focused on what was exposed and the steps they took to respond.

#Capcom's response

Capcom's actions, according to its October 22, 2026 press release:

1. Detected the unauthorized access on October 19, 2026 and immediately began blocking the access.
2. Set up an internal incident response headquarters on October 20, 2026 and reported to its external Information Technology Security Oversight Committee.
3. Reported to authorities on October 21, 2026: Osaka Prefectural Police and Japan's Personal Information Protection Commission.
4. Reset the 196 accounts that had passwords changed by the attacker.
5. Warned customers about the risk of phishing emails and messages impersonating Capcom.
6. Said they will contact affected customers going forward. Capcom offers dedicated support channels, including for the Americas and EMEA at https://www.capcom-support.com/hc/en-us/requests/new.

Capcom has not said whether affected customers will receive free credit monitoring, identity protection, or other support services.

#If you get a breach notification from Capcom

If Capcom emails you directly about this breach:

• Don't click links in the email. Go to cid.capcom.com yourself instead.
• Read the notification for details about what data of yours was exposed.
• Follow any instructions Capcom provides, but verify them by going to the official site directly.
• Keep the notification for your records.

Be aware that scammers will send fake breach notifications too. Treat every email as suspicious and verify it yourself.

#What about Monster Hunter, Street Fighter, and other games?

The breach affected the CAPCOM ID account system, not the games themselves. Your games still work. You can still play Monster Hunter, Street Fighter 6, and other Capcom titles.

However, your CAPCOM ID is used for online multiplayer and account features in those games, so securing that account protects your progress, purchases, and game data.

#If someone uses your information

If you believe someone used your CAPCOM ID or email address fraudulently:

1. Change your password immediately on cid.capcom.com.
2. Contact Capcom support through their official website. For the Americas and EMEA, use https://www.capcom-support.com/hc/en-us/requests/new. Explain what happened and ask them to review your account activity.
3. Report phishing attempts to your email provider so they can block similar messages.
4. If money was involved (fraudulent purchases, stolen payment details), contact your bank or card issuer and dispute the charges.
5. For identity theft concerns (if scammers used your personal details beyond just your Capcom account), file a report at IdentityTheft.gov (FTC) for a recovery plan.

#Sources

1. Capcom Co., Ltd., "Notice and Apology Regarding Customer Information Affected Through Unauthorized Access" (Oct 22, 2026). https://www.capcom.co.jp/ir/english/news/html/e261022.html
2. Video Games Chronicle, "Capcom says a data breach affected more than 11 million Capcom ID accounts, credit card details unaffected" by Chris Scullion (Oct 22, 2026). https://www.videogameschronicle.com/news/capcom-says-a-data-breach-affected-more-than-11-million-capcom-id-accounts-credit-card-details-unaffected/
3. The Verge, "Capcom data breach leaks over 11 million email addresses" by Jess Weatherbed (Oct 22, 2026). https://www.theverge.com/entertainment/1016436/capcom-data-breach-leaks-over-11-million-email-addresses
4. GamesRadar+, "Capcom confirms breach of 11.7 million ID accounts, promises stronger defences for the platform needed to play Street Fighter, Monster Hunter, and more online" by Anthony McGlynn (Oct 22, 2026). https://www.gamesradar.com/games/capcom-confirms-breach-of-11-7-million-id-accounts-promises-stronger-defences-for-the-platform-needed-to-play-street-fighter-monster-hunter-and-more-online/
5. FTC IdentityTheft.gov, data breach and identity theft recovery. https://www.identitytheft.gov/

Marcus Chen and his details are fictional.