The Field Briefing — Red Flag Cyber research desk

Capcom breach: 11,774,247 CAPCOM ID records accessed, email addresses included

What happened: Capcom said on October 22, 2026 that a third party accessed its CAPCOM ID membership service. The company detected suspicious activity on October 19, 2026, confirmed unauthorized access the same day, and blocked the access while investigating.

Who is affected: CAPCOM ID members worldwide — 11,774,247 records in total. For each record, the affected information includes the member's email address, account creation date and time, last login date and time, number of logins, and the client IP address used during the last login. For 43 records, dates of birth, gender, country or region, and nickname were also affected. Separately, 196 accounts had their CAPCOM ID login passwords changed without authorization; Capcom says those passwords have already been reset. Credit card information was not included.

The one action that matters: If you receive a suspicious email or message claiming to be from Capcom or a related party, do not access any URL in it and do not open any attached files — open Capcom's official site or your game yourself instead. Treat any message that quotes your Capcom account details as unproven until you have checked it on the official site.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/capcom

— Red Flag Cyber research desk. Full briefings, breach reports, and the free Spot the Phish checklist are on the site: https://red-flag-cyber-site.andrewdpeat.workers.dev