Capcom has issued a real CAPCOM ID security notice. That does not prove an email in your inbox came from Capcom. Compare the claim with the company’s October 22 notice and October 23 update, then reach support independently.
What did Capcom confirm?
Capcom detected suspicious access on October 19, 2026; the initial public notice followed October 22. Its initial figures were:
| Information or account activity | Reported scope |
|---|---|
| Email addresses and system information: account creation, last login, login count and last-login IP address | 11,774,247 records worldwide |
| Date of birth, gender, country/region and nickname | 43 of those records |
| Unauthorized password changes | 196 accounts; those passwords were reset |
These are worldwide record/account figures, not a count of U.S. victims. Capcom had not confirmed compromise of customers’ original passwords and said credit-card information was not included. Read the initial notice and its qualifications.
What changed in the October 23 update?
Capcom reported access to the Japanese e-Capcom store pages of 19 of the 196 accounts. Affected information included names, contact and address details, gender, birth date, purchase and inquiry histories, and saved address-book information. The 19 records are Japan-based, not a new worldwide total. The update again excludes credit-card information and says the impact investigation is complete, with monitoring continuing. Read Capcom’s follow-up.
How to check a CAPCOM ID email safely
- Leave the message and open a separate browser tab. Find the notice on Capcom’s public corporate website, using the official source links above.
- Reach support from that notice. Do not use a reply address, telephone number or attachment merely because it appears in the email.
- Describe the message without exposing secrets. Ask support about the notice you received. Never send a password, one-time code or payment-card details as proof of ownership in an unsolicited reply.
- Respect security warnings. A forum post saying a warning is harmless cannot authenticate your message. Pause and verify through the independent support route.
The FTC’s phishing guidance recommends contacting a company through a website or number you know is genuine. A message can repeat a real news event while sending you somewhere else.
Which Capcom support form should I use?
The notices link the Americas and EMEA to the Capcom support request form. Its breach-specific instruction asks you to include [Capcom ID Info Breach] in the ticket subject. Other regions have contact routes listed in the notices. Use the appropriate customer-support route rather than the media/investor contact.
What if I already clicked or shared information?
Your next step depends on what happened; receiving a notice alone does not establish account takeover.
- Only received the email: verify it independently before responding.
- Entered a password on a suspicious page: change it through the genuine service and change any other account using that password. Use available additional account-security protections.
- Cannot access your account or see an unexpected change: contact official Capcom support for account-specific help.
- Downloaded something suspicious: update your security software and run a scan.
- Disclosed financial or identity details separately: contact the affected institution and follow the FTC’s recovery steps for the information or payment involved.
CAPCOM ID email FAQs
Does a real breach notice prove my email is genuine?
No. Verify the individual message independently. A sender can copy a genuine announcement.
Were every user’s passwords stolen?
That is not what the initial notice says. Read the data categories and password-change qualification above; do not treat all affected records as the same exposure.
Should I replace my payment card just because I received this notice?
The notices do not establish a card exposure. If you separately gave a suspicious sender payment details or see an unauthorized transaction, contact your card issuer.
Should I ignore an email-authentication warning?
No. Leave the message and use the official support route. This guide does not authenticate a pasted email or an alleged mail-header problem.
Sources checked October 24, 2026. This guide uses Capcom’s October 22 notice and October 23 update, its linked support form, and FTC guidance. It is not an assessment of an individual inbox message.
ThinkItsAScam.com is independent and is not affiliated with Capcom. If sharing an experience in comments, remove private names, email addresses, account identifiers, phone numbers and tracking links.
Leave a Reply