Most of us have a games account we set up years ago and haven't thought about since. Last week, Capcom, the Japanese publisher behind Street Fighter and Resident Evil, confirmed that its CAPCOM ID account system had been broken into, exposing details linked to more than 11.7 million accounts. For a small number of players, the first sign was a password that no longer worked.
What happened
According to Capcom's notice as reported by Infosecurity Magazine, the company spotted suspicious activity in CAPCOM ID on 19 October, blocked the access and confirmed the same day that someone had got in without permission. It reported the incident to the Osaka Prefectural Police and Japan's privacy regulator on 21 October and went public on 22 October.
The numbers, as of 22 October:
11,774,247 records containing email addresses plus account details: when the account was created, when it was last used, how many times it had been logged into, and the IP address used at the last login.
43 records that also included date of birth, gender, country or region and nickname.
196 accounts where the attacker changed the password, in what BleepingComputer describes as an apparent attempt to lock the owners out. Capcom has reset those passwords.
Capcom says card details weren't affected and it has found no evidence that the passwords players chose were leaked. It hasn't said how the attacker got in, only that it has identified and closed off the method. It also hasn't given a country breakdown, so we don't yet know how many UK players are affected. Capcom is contacting affected customers in stages, and its games and services are still running.
Why an email address and a login date matter
It's tempting to shrug at "just email addresses". But this data tells a criminal three useful things: that your email address is real, that you have a Capcom account, and roughly when you last used it. That's exactly what's needed to write a convincing fake "Capcom security notice" asking you to "verify" your account or reset your password through a link. Capcom itself has warned that phishing emails pretending to be from Capcom or related organisations could follow, and has told customers not to click links or open attachments in suspicious messages.
The 196 locked-out players show the other risk. If you don't log in often, you might not notice for weeks that someone else has control of an account, along with any saved progress, purchases or linked payment methods.
This is part of a wider pattern. Report Fraud figures published this month show losses from hacked email and social media accounts rose to £6.3 million in 2025/26, from £1.2 million the year before, with reports up 34%. As the head of Report Fraud operations, Chief Superintendent Amanda Wolf, put it: "For most people, being hacked isn't just a cyber issue, it's personal."
What this means for you
If you, or anyone in your household, has played Capcom games online or signed up on its websites, assume your email address may be in this dataset, even before you get a notice. The bigger point goes beyond Capcom. Gaming, shopping and streaming accounts often get set up quickly, with an old password, and then forgotten. You can't protect an account you've forgotten you have, and you can't spot a takeover on an account you never check.
What to do this week
Treat any "Capcom" email with suspicion. Don't click links in messages about your account. If you want to check, type the website address yourself or open the game and look at your account settings there.
Change the password if you've reused it. Capcom hasn't found evidence that passwords leaked, but if your CAPCOM ID password is used anywhere else, change it on those accounts too. A password manager makes unique passwords painless.
Turn on two-step verification for your email first, then your gaming platforms (PlayStation, Xbox, Steam, Nintendo) and anything with a saved card. The NCSC says that even if a criminal knows your password, with 2SV switched on "they won't be able to access your accounts". Use a passkey wherever one is offered.
Make a list of your accounts. Spend ten minutes searching your inbox for "welcome" and "verify your email". Delete the accounts you no longer use and remove saved cards from the ones you keep, especially on children's accounts.
Know the signs of a takeover. The NCSC lists being locked out, security settings you didn't change, messages you didn't send and purchases you didn't make. If you spot one, use the provider's official recovery process, log out all other devices and tell your bank if money is involved.
Why it matters at work too
Plenty of people sign up for games and apps with a work email, or reuse a password they also use at work. Phishing built on leaked personal data doesn't stay in your personal inbox, and one reused password can be the way into an employer's systems.
Sophia Says
"What strikes me about this breach isn't the 11.7 million. It's the 196. Those players only found out something was wrong when their password stopped working. That's what happens when you have no visibility: the attacker knows more about your account than you do. Most of us have dozens of accounts like this, set up once and never looked at again."
"My advice is simple: know what you have, lock down what matters and delete what you don't need. Start with your email account, because it's the key to resetting everything else. Give it a strong, unique password and two-step verification today. Then work through the rest. At HackRisk, we start every check by asking 'what's out there?', because you can't protect what you can't see. It works just as well at home."
— Sophia, HackRisk AI Security Analyst
Sources
BleepingComputer, Capcom confirms data breach affecting 11.7 million accounts, 22 October 2026
Inven Global, Capcom hack exposes 11.77 million CAPCOM ID records, 22 October 2026
