Somebody made a CAPCOM ID in 2019 to play Monster Hunter online with a friend. They used it twice that year and forgot about it. On October 22, 2026, that account became a row on a list of 11,774,247 records: their email address, the day and hour they signed up, the number of times they have ever logged in, and the IP address they last logged in from. A week from now an email will arrive that says their CAPCOM ID has unusual activity, and it will know the year they joined. That is what the Capcom data breach looks like for one person.
Confirmation: confirmed by the company. Capcom published a signed notice on October 22, 2026.
Capcom named the risk itself. Its notice says there is “a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties.” That is the shape of the Capcom data breach: not a stolen credit card, but a stolen address and enough detail to make a fake message convincing.
What happened in the Capcom data breach
Capcom detected suspicious activity on October 19, 2026, and confirmed unauthorized access the same day. It began blocking the access immediately. On October 20 it set up an internal incident response headquarters, confirmed that the access reached customer information, and found unauthorized changes to some account passwords. On October 21 it reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission.
President and COO Haruhiro Tsujimoto signed the public notice on October 22. You can read Capcom’s English notice in full. BleepingComputer reported the confirmation the same afternoon.
Two things Capcom has not said. It has not said when the intrusion started, so the window is unknown. It also has not described how the attackers got in, beyond stating that it “identified and addressed the attack method.” The 11,774,247 figure is a count as of October 22, and Capcom says it continues to investigate the scope. Treat it as a floor rather than a final number.
CAPCOM ID is the one account that works across Capcom’s web services and that some of its games require for online play. Capcom says the services still work and that the breach does not affect anyone’s ability to play.
What the Capcom data breach exposed, and what somebody can do with it
For all 11,774,247 records, two categories leaked.
Email addresses. This is the item that follows you. An address plus a brand name is the raw material for a phishing message, and the brand here is one the recipient actually has an account with. Capcom says registered addresses can keep being used, so nobody has to change theirs.
System-specific identifiers. Capcom lists these as the date and time the account was created, the date and time of last login, the number of logins, and the client IP address used at last login. These are the details that make a fake email land. A message that says “your CAPCOM ID, created March 2019, was accessed from a new location” is far harder to dismiss than a generic alert, because the first half of it is true.
For 43 records, more leaked: date of birth, gender, country or region, and nickname. Those four are the answers to identity questions on other services.
Separately, somebody changed the CAPCOM ID passwords on 196 accounts without authorization. That is tampering rather than leakage. Capcom has already reset those passwords.
Two things did not leak. Capcom says credit card information “was not included among the affected information.” It also says it “has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves.”
What to do now
Most of this has nothing to do with OptMsg.
Go to CAPCOM ID directly and change your password. Type the address into your browser. Do not use a link from an email, because a link in an email about a breach is exactly what an attacker would send you this week.
Turn on the strongest sign-in method the account offers. Then do the same on any account where you reused that password. If you cannot remember where you reused it, that is the argument for a password manager — it remembers for you, and it generates a different password for every site so one leak stays one leak.
Expect the follow-up phish, and expect it to be good. The attackers know your address, your join date and your login history. Capcom’s own advice is to be careful with any suspicious message and to avoid opening URLs or attachments inside it. In short: a real company asking you to confirm something will survive you ignoring the email and going to the site yourself.
Watch for a password-change notice you did not request. 196 people got one. If yours arrives, use Capcom’s regional support channels rather than replying.
Do not wait for Capcom to contact you. The notice says Capcom will contact affected customers sequentially, which with 11.7 million records will take a while.
How OptMsg changes this exposure
The breach happened at Capcom, inside Capcom’s own systems. Nothing about an email provider changes that, and OptMsg would not have stopped it. What an inbox can change is what happens on your side afterward, and there are exactly two things.
The first is the sign-in. Your OptMsg account has no password, so a password stolen from another site cannot open your inbox. Credential stuffing needs a password to try. This matters more than it sounds, because your email is the reset route into most of your other accounts — keep that door shut and the rest stay shut with it. That is the Secure argument, and it is the whole of it.
The second is where the next message lands. Mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. The impersonation email Capcom warned about arrives from a sender you have not approved. So it arrives in Trash, where you are not reading quickly between two other things.
Now the limits, plainly. This does not cover a compromised device. It does not cover you typing your details into a live phishing page you reached some other way. It does not cover somebody holding your unlocked phone. And it does nothing about the 11,774,247 records the Capcom data breach already put out there. The argument is about the blast radius on your side, and that is all it is.
Create Your Account — Your Inbox. Your Rules.
Frequently asked questions
Was my password stolen in the Capcom data breach? Capcom says it has not confirmed any compromise of passwords that customers set themselves. Separately, 196 accounts had their passwords changed without authorization, and Capcom has reset those. Changing yours anyway costs a minute.
Was my credit card exposed? No. Capcom’s notice states that credit card information was not included among the affected information.
How many people were affected? Capcom gives 11,774,247 records worldwide as of October 22, 2026. There is no country-by-country breakdown, so the US share is not public. Capcom says it is still investigating the scope, so the figure may grow.
Do I need to change my email address? No. Capcom says addresses registered with CAPCOM ID can keep being used. The exposure means more scam mail aimed at that address, not that the address stops working.
Why is my last login IP address a problem? On its own it is not. Put it next to your join date and login count, though, and somebody can write a fake security alert that contains true details about your account — which is what makes a phishing message work.
Sources
- Capcom, “Notice Regarding Unauthorized Access to CAPCOM ID,” October 22, 2026 — https://www.capcom.co.jp/ir/english/news/html/e261022.html
- Capcom, Japanese original notice, October 22, 2026 — https://www.capcom.co.jp/ir/news/html/261022.html
- BleepingComputer, “Capcom confirms data breach affecting 11.7 million accounts,” October 22, 2026 — https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/
- Capcom USA customer support — https://www.capcom-support.com/hc/en-us/requests/new
Previous in Breach Breakdown: Assurance Retraite Data Breach: Your Pension File Is Now Someone Else's Script
Next in Breach Breakdown: Quest Diagnostics Data Breach Exposed Patient Records: What To Do Now
