Hackers Breached 11.7 Million Capcom Accounts and Are Already Using the Stolen Emails

Your Old Capcom Account Is Being Used Against You Right Now

You made an account. You played the game. You moved on. Millions of people did exactly this with Capcom ID, the company's unified login for games like Resident Evil, Street Fighter, and Monster Hunter. Many of those accounts went dormant years ago, untouched, forgotten.

Capcom detected unauthorized access on October 19, 2026. Three days later, on October 22, they told the public. In the gap between those two dates, attackers were already inside accounts. Already changing passwords. Already locking real owners out.

This is what a modern breach looks like. Fast, targeted, and aimed at people who never saw it coming.

How Did Attackers Get Into 11 Million Accounts?

Capcom hasn't disclosed exactly how the breach happened, and that detail matters less than what the attackers walked away with.

The exposed data for 11,774,247 accounts includes email addresses, account creation dates, last login dates, login counts, and the IP address used at the most recent login. No passwords stolen in bulk. No credit card numbers. That sounds reassuring until you understand how attackers think.

An email address is a weapon. The creation date tells an attacker how old the account is. The last login date tells them how dormant it is. The login count tells them how engaged you were. The last IP address tells them roughly where you live. Together, that profile is a targeting kit for phishing and social engineering campaigns. The attacker doesn't need your password if they can trick you into giving it to them with a convincing email that already knows your account details.

A smaller group, 43 accounts, had deeper personal data exposed: date of birth, gender, country or region, and nickname. Those accounts carry more risk because the phishing bait gets sharper the more an attacker knows about you.

Then there are the 196 accounts where Capcom confirmed the attacker logged in and forcibly changed the passwords. Those people are locked out of their own accounts right now. That number is small relative to the full 11.7 million. It isn't small if it's yours.

What the Numbers Actually Mean

11,774,247 compromised accounts worldwide. That's roughly the population of Belgium.

196 accounts with confirmed attacker access and forced password changes. Capcom disclosed this directly, which at least tells you they were monitoring for active abuse.

3 days between detection and public disclosure. Capcom reported the incident to law enforcement and Japan's Personal Information Protection Commission on October 21, giving authorities a day's head start before the public announcement on October 22. That sequencing is standard but cold comfort if you spent those three days unaware.

Zero passwords stolen in bulk, according to Capcom. Zero credit card records involved. These are genuine limitations on attacker capability in this specific breach. They don't make the exposed metadata harmless.

What Should You Do Right Now?

You don't need to have been an active Capcom user to be at risk. If you ever created an account, your email address is likely in this dataset.

1. Change your Capcom ID password immediately. Even if Capcom says passwords weren't stolen in bulk, changing yours removes any residual risk from the accounts that were actively compromised. Do it now, before you finish reading.

2. Check if the same email and password combination exists anywhere else. This is the real danger. If you used that email and a reused password on another service, attackers will run credential-stuffing attacks against banking, retail, and social accounts. A password manager will show you every site where you've reused a credential.

3. Enable two-factor authentication on Capcom ID and every account sharing that email. A one-time code sent to your phone blocks an attacker who only has your password. Passkeys are even stronger. Both are free.

4. Watch your inbox for impersonation emails. Attackers have your email address and they know you have a Capcom account. Expect emails that look like official Capcom messages warning you about "suspicious activity" and asking you to click a link. That link will not go to Capcom. Check the sender domain character by character. When in doubt, navigate directly to capcom.com by typing it into your browser.

5. Consider a data removal request. Services like DeleteMe or Privacy Bee can scrub your information from data broker databases. That won't undo this breach, but it reduces your exposure surface for future ones. Most offer free trials.

6. Freeze your credit if you're in the US. No financial data was exposed here, but a credit freeze is free at all three bureaus, takes five minutes, and can be temporarily lifted when you need it. There's no good reason not to have one.

The Thing Nobody Talks About

The instinct after a breach is to blame the company. Sometimes that's right. But there's a structural reality that doesn't get enough attention.

Millions of people create accounts for games, apps, and services, hand over real personal information, and then forget the account exists. The company retains that data, sometimes for years, because deletion costs effort and retention is free. The user has no idea the data is still sitting there. Then a breach happens and a decade-old account becomes a fresh problem.

You cannot control what companies retain. You can control what you give them. Use unique email aliases when services allow it. Use strong, distinct passwords everywhere. Delete accounts you no longer use. Opt out of data retention where services provide that option.

The attacker who hit Capcom got eleven million targets to work with partly because eleven million people created accounts and stopped paying attention. The lesson isn't to stop playing games. It's to treat every account you create as a small, ongoing liability that needs a few minutes of maintenance per year.

Do this now:

• Change your Capcom ID password
• Check for reused passwords on other accounts with the same email
• Turn on two-factor authentication
• Do not click any email claiming to be from Capcom

Sources

• hothardware.com
• windowscentral.com