Capcom breach exposes 11.7 million player account records
Capcom disclosed that a third‑party accessed its CAPCOM ID service, extracting 11.7 M account records and changing passwords on 196 accounts. The incident underscores the need for strong identity‑access controls and audit‑ready evidence for regulators.
ADTP Breach Watch· October 23, 2026· Help Net Security
SeverityHigh
Type🔑 Breach
ConfidenceHigh
ReportedOct 23, 2026
Media & EntertainmentGaming publishersOnline service providersUnknown
What happened
On Oct 19, Capcom detected suspicious activity on its CAPCOM ID platform. A third‑party attacker accessed the system, exfiltrating 11,774,247 account records and altering passwords on 196 accounts before the company reset them and blocked further access.
Why it matters for trust and compliance
The breach illustrates a gap in continuous IAM monitoring and password‑reset governance—control areas that a trust‑and‑control‑assurance program must evidence for audit readiness.
Provides evidence of the need for continuous IAM event monitoring and rapid incident detection.
Supports audit‑ready documentation of password‑reset procedures and user‑account governance.
Who is affected
Gaming publishersOnline service providers
Recommended actions
Implement multi‑factor authentication and tighten password‑change privileges.
Enable real‑time anomaly detection on login activity and retain logs for audit purposes.
Refresh incident‑response playbooks to include credential‑theft scenarios.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.