Capcom Breach Exposes 11.7 Million Account Records, Triggers Phishing Threat
Capcom disclosed that an attacker accessed its CAPCOM ID service, exposing over 11.7 million email, IP and activity records and changing passwords on 196 accounts. The leak fuels credential‑phishing campaigns, highlighting the need for strong access controls and user awareness in audit‑ready environments.
ADTP Breach Watch· October 23, 2026· Malwarebytes Labs
SeverityHigh
Type🎣 Breach
ConfidenceHigh
ReportedOct 23, 2026
Technology & SaaSVideo‑game publishers and online entertainment platformsAny SaaS provider that uses a unified consumer‑identity systemUnknown
What happened
Capcom’s online membership service was compromised, leaking more than 11.7 million account records—including email addresses, IP addresses, activity logs, and dates of birth for a subset. Passwords on 196 accounts were altered without user consent; those passwords have been reset.
Why it matters for trust and compliance
The incident underscores a lapse in identity‑and‑access management and continuous monitoring—core control objectives that map to multiple frameworks (e.g., NIST CSF 2.0). Robust MFA enforcement, privileged‑change logging, and phishing‑aware training are essential for defensible audit evidence.
Demonstrates the need for continuous MFA enforcement and immutable change‑log evidence.
Provides a concrete example for security‑awareness programs to address breach‑derived phishing.
Who is affected
Video‑game publishers and online entertainment platformsAny SaaS provider that uses a unified consumer‑identity system
Recommended actions
Enable and mandate MFA for all user accounts.
Implement immutable logging of password‑change events and set alerts for anomalous activity.
Roll out targeted phishing‑awareness training referencing this breach.
Collect MFA and log‑audit evidence to support framework‑aligned audit readiness.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.