Michael JohnsonCapcom’s second update on the cyber incident narrowed the confirmed impact on its e-Capcom online store: its pages were accessed through 19 accounts whose passwords had previously been changed without authorization. The update was published on October 23, 2026, one day after the first notice about the compromise of CAPCOM ID data.
According to the company’s update, the 19 records may have included names, phone numbers, postal addresses, gender, dates of birth, purchase histories, support inquiries and saved address books. Capcom says the records relate to Japan. Bank card information was not included among the affected data.
How CAPCOM ID and the store are connected
CAPCOM ID is a single account for Capcom web services and some online game features. In its October 22 notice, the company reported 11,774,247 affected records containing email addresses and account technical data: registration and last-login times, login counts and the IP address used for the last login. A further 43 records also included dates of birth, gender, country or region, and a nickname.
In that first notice, Capcom said that passwords had been changed without authorization on 196 accounts. A subsequent investigation linked access to e-Capcom pages to 19 of those accounts; the company found no data compromise caused by such password changes in the remaining accounts. Capcom did not identify users’ originally set passwords as data confirmed to have been exposed. The company said it had reset the passwords of affected accounts.
What account holders should do
Capcom says it has completed its investigation into the impact and will continue monitoring CAPCOM ID and related services. The company plans to notify affected customers. Users should be cautious of unexpected emails, text messages and calls that may use personal information to impersonate Capcom; the company advises against opening suspicious links or attachments.
To check a specific case, use the official support channels listed in Capcom’s October 23 notice. The practical distinction in the company’s findings is that the wider dataset involves email addresses and CAPCOM ID activity information, while confirmed access to e-Capcom customer data concerns 19 accounts in Japan.