> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Capcom ID Breach Hits 11.7M Records: What to Do
- URL: https://blog.harshkohli.com/capcom-id-data-breach-11-million/
- Published: 2026-10-24T19:06:01.000Z
- Updated: 2026-10-25T07:39:01.000Z
- Description: Capcom confirms a Capcom ID breach exposing 11.7 million email records and 196 hijacked accounts. What leaked and how to avoid the phishing that follows.
- Author: Harsh Kohli
- Tags: Tech News, Gaming

If you've ever made a Capcom ID to play Street Fighter 6 online, check your inbox carefully for the next few weeks. Capcom has confirmed that someone got into the account system behind Capcom ID and pulled data tied to more than 11.7 million records. I first saw it in [IGN's post on X](https://x.com/IGN/status/2113216548601057763?ref=blog.harshkohli.com), then read [Capcom's own notice](https://www.capcom.co.jp/ir/english/news/html/e261022.html?ref=blog.harshkohli.com) to get the exact numbers.

## What happened

Capcom says it spotted suspicious activity on Capcom ID, started blocking it right away and confirmed the same day that an outside party had got in. As of October 22, the company counts 11,774,247 affected records worldwide. Those records hold email addresses plus some account details: when the account was created, the last login time, the number of logins and the IP address used at the last login.

A much smaller group got hit harder. For 43 records, date of birth, gender, country or region and nickname were also exposed. And on 196 accounts, the attacker actually changed the password. Capcom says it has reset those passwords and hasn't found any sign that the passwords people set themselves were stolen. Credit card details weren't part of the data, according to the company.

Capcom has reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. It says it has found and closed the attack method, and Capcom ID, along with every game that uses it, is still working normally. [BleepingComputer](https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/?ref=blog.harshkohli.com) and [Engadget](https://www.engadget.com/2296218/capcom-confirms-data-breach-that-affected-117-million-users/?ref=blog.harshkohli.com) have covered it too.

## Why it matters

An email address on its own doesn't sound like much. The trouble is what comes next. Scammers now know that millions of these addresses belong to people who play Capcom games, so they can send very believable fake emails about "account problems", free DLC or a password reset. Capcom warns about exactly this in its notice. The 196 hijacked accounts also show the attacker wasn't just reading data, which is why I'd treat this one as more than a routine leak.

## What to do

- **Distrust any Capcom email for a while.** Don't click links or open attachments in messages claiming to be from Capcom. Go to the Capcom ID site yourself by typing the address.
- **Change your password if you reused it.** Capcom says self-set passwords weren't compromised, but if your Capcom ID password is the same one you use for your email or Steam, change it anyway.
- **Check that you can still log in.** If your password suddenly doesn't work, you might be one of the 196\. Capcom has set up a [dedicated support form](https://www.capcom-support.com/hc/en-us/requests/new?ref=blog.harshkohli.com) for this incident.
- **Turn on two-step login** for your email account, since that's the real key to everything else.

If you want an extra layer against dodgy links on your phone, a filtering DNS service can block a lot of known scam domains. I walk through it in my guide to [Private DNS on Android](https://blog.harshkohli.com/private-dns-android-block-ads/).