For 43 accounts, the exposure went further, covering date of birth, gender, country or region and nickname. A follow-up notice from Capcom on 23 October added that the intruder opened the e-Capcom store pages of 19 of those accounts, exposing names, phone numbers, addresses and purchase history for customers in Japan. The attackers did not get hold of passwords set by users, but they changed the passwords of 196 accounts without authorisation, and Capcom has already reset those. No credit card information was affected.

According to Capcom's account of the timeline, the breach was spotted on 19 October 2026 and access was blocked on discovery, a task force was set up the next day, and the incident was reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. Capcom has not said how the attackers got in, only that the method has been identified and dealt with. It has completed emergency measures, begun contacting affected customers and set up a dedicated contact point.

The immediate practical risk is phishing. Because email addresses were exposed, Capcom warns that users may receive fraudulent messages pretending to be from the company, and it urges people not to open suspicious links or attachments. It is not the company's first brush with attackers either: in November 2020 Capcom revealed a ransomware attack that saw hundreds of thousands of pieces of personal data stolen from its servers, including customer and former employee details.