Capcom lost 11.7 million account records. The 196 changed passwords are the part to study.

01 What Capcom disclosed, day by day

Capcom says it has identified and addressed the attack method. It has not said what that method was, and it has not named anyone responsible [ CyberInsider 2026 ] . CAPCOM ID stays online and gameplay is unaffected. Capcom reset the 196 changed passwords and is contacting affected customers one by one.

Credit card data was not in the affected set. Capcom also states that it “has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves” [ Capcom 2026 ] . Read that sentence carefully. It speaks to leaked passwords. It does not explain how 196 of them changed.

02 What login telemetry tells an attacker

The exposed fields look dull on a compliance form. For every one of the 11,774,247 records, Capcom lists the email address, the account creation time, the last login time, the login count and the client IP address of the most recent login. For 43 accounts the attacker also got date of birth, gender, country or region and nickname [ Capcom 2026 ] .

Put those fields together and an attacker gets a target list sorted by value. Login count and last login separate the active players from the accounts nobody has touched in years. Dormant accounts are the ones whose owners will not notice a takeover. Active ones are the ones worth phishing, because their owners expect mail from Capcom.

The last-login IP address adds location and internet provider. A phishing email that names your country, your provider and the date you last played reads like a genuine security alert. The email address is the delivery channel. Capcom confirms those addresses stay valid and warns customers about messages that impersonate Capcom or its partners [ Capcom 2026 ] .

The email list also feeds credential stuffing. Verizon found that in the median case only 49% of a person’s passwords across different services were distinct from each other [ Verizon 2025 ] . An attacker with 11.7 million confirmed addresses and a stack of older breach dumps has a ready-made list to try against other services.

03 The 196 passwords: takeover inside the identity system

Most account takeovers happen at the front door. The attacker has the password from another breach and logs in. A changed password inside a breached identity system points somewhere else. The attacker reached a function that sets credentials.

Capcom has not said which function. In any identity platform, a password changes through one of four routes, and each leaves different evidence:

• The owner’s own session. The attacker holds a valid session token or the old password and uses the normal change form.
• The reset flow. The attacker controls the recovery email, guesses or replays a reset token, or abuses a flaw that issues tokens for any account.
• A support or admin tool. A help-desk console or internal API sets a new password on request. One compromised staff login or one exposed internal endpoint opens every account.
• A direct write to the data store. The attacker reaches the database and overwrites the password hash.

The ratio is the clue worth thinking about. 11,774,247 records read, 196 accounts changed. An attacker with a bulk write path could have changed far more. A small number points to something selective: chosen accounts, a slow route, or a test run that Capcom stopped on day one. Capcom’s detection inside a single day deserves credit. Plenty of platforms would have found out from the 196 owners.

04 How to catch a password change nobody asked for

A password change is a high-value event with a clear owner. That makes it one of the easiest things in an identity platform to monitor, and one of the most often ignored. OWASP’s verification standard asks for secure notifications to users after changes to authentication details, such as credential resets and email changes, and after logins from unknown or risky locations [ OWASP ASVS ] . It also asks that users hear about every change to an authentication factor [ OWASP ASVS ] .

The last rule closes the loop. The account owner is the only party who knows for certain that they did not ask for the change. Give them a fast way to say so, and your 196 becomes 196 alerts within the hour.

05 Protect the platform that holds every login

Verizon’s 2025 research found that compromised credentials were an initial access vector in 22% of breaches. Across two years of single sign-on logs, the median day saw credential stuffing make up 19% of all authentication attempts, rising to 25% at enterprises [ Verizon 2025 ] . Your identity platform takes that pressure every day. These controls keep a breach of one part from turning into a takeover of everything.

• Separate the reads from the writes. The service that shows a profile does not need permission to set a password. Give credential changes their own service, their own database role and their own logs.
• Put the support console behind phishing-resistant MFA. Every staff account that resets customer passwords is an admin account. Treat it like one, with hardware keys or passkeys and a short session.
• Require step-up for sensitive changes. Ask for the current password or a second factor before a password or recovery-email change, even inside a valid session.
• Rate-limit by route. Cap resets per account, per IP and per staff user, and alert when a cap is hit.
• Keep telemetry away from the data it describes. Login counts and last-login IP addresses are useful to your fraud team. Store them where a read of the account table does not also return them.
• Test the side doors. Include the reset flow, the help-desk tool and the internal APIs in every penetration test of the identity platform.

06 What to tell customers on day one

Capcom’s notice covers the essentials: what was taken, what was not, what it changed, and how to reach it. It runs a toll-free line in Japan, 0120-801-271, and support channels for the USA, EMEA and Asia [ Capcom 2026 ] . If you face the same week, your customers need four things from you, in this order.

• Exactly which fields left. Name them. “Email address and last-login IP address” lets a customer judge their own risk.
• Whether their account was touched. Tell the affected few directly and separately. A customer whose password you reset needs a different message from one whose email address was read.
• What you will never send. State that you will not email a link to reset a password or ask for payment details. Then phishing that cites your breach stands out.
• One safe action. Type the site address, sign in, change the password, and change it anywhere else it was reused.

An attacker needs one route that sets a password. You can find every route first. Your Threat Map traces each way a credential changes in your customer platform, proves which ones an outsider reaches, and ranks the fixes by how many accounts each one protects. 14 days, from $5,000. Enterprise-grade. Not enterprise-priced.