Capcom ID Breach: 11.7 Million Records Exposed, 196 Accounts Hijacked

What Capcom Confirmed

Capcom said hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer email addresses and associated information, according to BleepingComputer. The company detected suspicious activity and confirmed unauthorized access on 19 October 2026.

Help Net Security gives the precise figure: 11,774,247 records worldwide. The “more than 11.7 million” headline and the exact count describe the same incident; the exact figure is stated in records.

Capcom acted on the regulatory side within two days of confirming the intrusion. It reported the incident to police and Japan’s Personal Information Protection Commission on 21 October.

What Was Exposed, and What Was Not

For the bulk of the records, the exposed fields were account creation date, last login timestamp, number of logins and the IP address used at last login, alongside the email address itself.

A far smaller group had more exposed. For 43 accounts, dates of birth, gender, nicknames and countries were also exposed.

The one clearly reassuring point: Malwarebytes reports that credit card data was not affected.

The 196 Hijacked Accounts

The part of the incident that goes beyond data exposure is account takeover. According to Help Net Security, attackers changed passwords on 196 accounts without authorization. Capcom reset those accounts and says it found no evidence that customer-set passwords were compromised.

As of Help Net Security’s report, no group had claimed responsibility and the investigation was ongoing. Attribution, the entry method and the full scope may therefore still change.

What This Means for Algerian Players and Platforms

Capcom’s figure is a worldwide count, and the sources reviewed do not break it down by country, so the number of Algerian accounts involved is unknown. The risk is still practical: a membership email address that is now in criminal hands can be used to build a convincing message. Three habits follow.

1. Enable two-factor authentication on every gaming and platform account

Malwarebytes advises users to enable two-factor authentication. The 196 hijacked accounts show why a password alone is a thin barrier once an attacker is inside a membership system. For households where several family members share one email address across services, this step matters most.

2. Never follow a link in a message that claims to come from the game publisher

The same Malwarebytes guidance tells users to open their browser and go to cid.capcom.com directly, rather than follow links in messages. The rule generalises: type the address, or use the official app, whenever a message about your account arrives.

3. Teach the younger players first

Players who sign up with their real email address are the people for whom a leaked address is most useful to a scammer. Parents, school clubs and gaming communities can pass on the two habits above in a few minutes. This is our assessment of where awareness effort pays off, not a finding of the sources.

The Structural Lesson

The Capcom case is a reminder that a breach does not need to touch payment data to cause harm. Records of when you last logged in, from which IP address and how often are the raw material for credible lures. The data fields are modest; the scale, at 11,774,247 records, is what makes the exposure significant.

For Algerian readers the practical takeaway is not panic but routine: unique passwords, two-factor authentication, and a firm rule about direct navigation to account pages.

Frequently Asked Questions

Sources & Further Reading

• Capcom confirms data breach affecting 11.7 million accounts — BleepingComputer
• CAPCOM ID data breach: 11 million records exposed — Help Net Security
• Capcom warns of phishing after 11.7 million records exposed — Malwarebytes