# Capcom CAPCOM ID unauthorized access exposes 11.7M records; phishing warning issued

> Capcom detected unauthorized access to its CAPCOM ID membership service on 2026-10-19, exposing 11,774,247 records (email addresses and account-activity metadata including client IP addresses). Passwords were changed without authorization on 196 accounts, and Capcom warns of follow-on phishing impersonating the company. Credit card data was not affected.

- **Published:** 2026-10-23T13:40:07Z
- **Last reviewed:** 2026-10-23T13:40:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4270
- **ID:** TL-2026-4270
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-19 Capcom detected suspicious activity indicating potential unauthorized access to CAPCOM ID, the account service used across its online games and services, and confirmed the breach the same day. Per Capcom's 2026-10-22 notice, 11,774,247 records were exposed worldwide. The records contain email addresses and system identifiers: account creation date and time, last login date and time, number of logins and the client IP address used at last login. A further 43 of these records also contain date of birth, gender, country/region and nickname. Capcom states that credit card information was not affected.

Capcom confirmed unauthorized password changes on 196 accounts, which indicates the intruder had write-level capability over account credentials and not just read access. Capcom reset the passwords on those accounts. The company states it completed emergency blocking of the unauthorized access and has identified and addressed the method of attack. It has not disclosed that method, so the initial access vector, the vulnerability or credential type involved, the dwell time and the exfiltration mechanism are unknown. Services that use CAPCOM ID remain operational and the investigation is ongoing.

Response timeline: on 2026-10-20 Capcom set up an internal incident response headquarters and reported the incident to its IT Security Oversight Committee. On 2026-10-21 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. The press notice was issued on 2026-10-22 with dedicated support channels for Japan, the Americas, EMEA and Asia/Oceania.

Downstream risk: the exposed email addresses combined with login metadata (last login, login count, IP address) give attackers material for credible phishing and account-takeover attempts against CAPCOM ID users and the platform accounts that can be linked to it (PlayStation, Xbox, Steam, Epic Games, Nintendo, per Malwarebytes). Capcom instructs recipients of suspicious messages impersonating Capcom not to open URLs or attachments. Malwarebytes recommends enabling authenticator-app two-factor authentication, reviewing account and linked-platform details, and visiting cid.capcom.com directly instead of following email links. No threat actor, malware, CVE or attacker infrastructure has been publicly attributed. Capcom's 2020 Ragnar Locker ransomware incident is a separate, earlier event and is not linked to this one in any source.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1098 Account Manipulation
- T1531 Account Access Removal
- T1589.002 Email Addresses
- T1598 Phishing for Information
- T1566 Phishing

## Sources

- [Capcom official breach notice (11,774,247 records; 43 with DOB/gender/country/nickname; 196 unauthorized password changes)](https://www.capcom.co.jp/ir/english/news/html/e261022.html)
- [Resident Evil maker Capcom warns of phishing after 11.7 million records exposed (Malwarebytes Labs)](https://www.malwarebytes.com/blog/data-breaches/2026/10/resident-evil-maker-capcom-warns-of-phishing-after-11-7-million-records-exposed)
- [Capcom 2021 update on the 2020 ransomware incident (prior, unrelated incident, context only)](https://www.capcom.co.jp/ir/english/news/pdf/e210112.pdf)
- [Capcom 2020 notice of unauthorized access (prior, unrelated incident, context only)](https://www.capcom.co.jp/ir/english/news/pdf/e201104.pdf)
- [Gaming Company Confirms Ragnar Locker Ransomware Attack (2020 incident, context only)](https://www.govinfosecurity.com/gaming-company-confirms-ragnar-locker-ransomware-attack-a-15385)
- [Capcom Says Personal Data of Thousands More Stolen in Ransomware Attack (SecurityWeek, 2020 incident, context only)](https://www.securityweek.com/capcom-says-personal-data-thousands-more-stolen-ransomware-attack)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4270