Capcom Data Breach: What the CAPCOM ID Leak Exposed, and Why Melonbooks and Animate Are Blocked Overseas

The Capcom data breach exposed customer email addresses and login details from 11,774,247 CAPCOM ID records worldwide, Capcom confirmed on October 22, 2026. No credit card data was taken, and Capcom has not found any leak of the passwords players set themselves. The breach is the largest in a wave of cyberattacks on Japanese entertainment companies this month. In the same week, the manga stores Renta! and Comic CMOA went offline, and Animate, Melonbooks and Gamers shut their online shops to overseas visitors. Here's what leaked, what to do, and why so many Japanese sites are suddenly hard to reach.

What Happened in the Capcom Data Breach?

A third party broke into CAPCOM ID, the shared account Capcom uses for its web services and for some online games. Capcom says it spotted suspicious activity on October 19, 2026, blocked the access right away and confirmed the break-in the same day. Here is the timeline from Capcom's own notices:

Capcom says it has identified and dealt with the attack method, but it hasn't said how the attacker got in. Anime News Network's report gave the count as 11,777,247. Capcom's notice says 11,774,247, in both the English and Japanese versions. The number matters less than what is behind it.

What Was Leaked in the CAPCOM ID Breach?

Most of the 11.7 million records are a customer email address plus account metadata, not personal details. Capcom splits the damage into three groups:

Credit card information is not part of any group. For the other 177 hijacked accounts, Capcom says it found no information that was compromised. For almost everyone affected, the risk is the email address. A list of 11 million emails known to belong to Capcom players is exactly what scammers need, which shapes what you should do next.

What Should Capcom Players Do Now?

Capcom says your registered email can still be used and your games are not affected. It warns that the leaked data could be used for fake emails, texts or phone calls that pretend to come from Capcom. Some practical steps:

• Don't click links in "Capcom security" messages. Go to the Capcom site yourself instead. Capcom's second notice adds texts and phone calls to the warning.
• Change your password if you reuse it. Capcom found no leak of customer-set passwords, but changing a password you also use elsewhere costs nothing.
• Check your account. If you can't log in, your password may be one of the 196 that Capcom reset. Capcom says it will contact affected customers directly.
• Use the official support channels: the Capcom support inquiry form for the Americas and Europe, info-asia@capcom.com for Asia and Oceania, and a toll-free line in Japan (0120-801-271, 10:00 to 20:00 JST).

Capcom is the biggest name in this wave, but for anime and manga fans outside Japan the more visible problem is that Melonbooks, Animate and other stores are now blocked.

Why Are Melonbooks and Animate Blocked Outside Japan?

Both stores are blocking foreign visitors as a security measure. We loaded each site from outside Japan on October 23, 2026, and this is what came up:

None of these notices gives an end date. Melonbooks is the only store offering a workaround: it says it is "considering to handle each case individually" and asks overseas customers who want to use the store to email melonbooks-tsuhan@melonbooks.co.jp. Japan-based proxy shopping services should still be able to order for overseas fans, since they buy from inside Japan. Blocking foreign traffic is a common quick fix during an attack wave: it shrinks the number of places an attack can come from while a store reviews its security, but it also locks out every legitimate foreign customer.

Animate, Melonbooks and Gamers have not reported any breach. They are closing the door because of what happened to the stores below.

Which Other Japanese Anime and Manga Sites Were Hacked?

At least three more book and manga services confirmed attacks or possible leaks in October 2026:

Renta! says it will consider how to make up for rental titles customers could not read during the outage. Papyless has not yet said whether any customer data was taken. We covered the CMOA case in detail in our Comic CMOA hack explainer. The bigger question is why this is happening to so many companies at once.

Why Are So Many Japanese Companies Being Hacked in 2026?

Publicly reported security incidents in Japan are at a record level this year. Trend Micro counted 607 incidents announced by Japanese organizations from January to September 2026, already more than the 594 in all of 2025. By October 9, the count reached 659, passing the previous record of 645 set in 2024, and the first nine days of October alone added 52. Trend Micro says announcements rose sharply from September.

A Teikoku Databank survey of 1,328 Japanese companies, run from October 9 to 14, shows how common leaks have become:

• 16.2% of companies have had a data leak or a possible one at some point.
• Among large companies, that rises to 30.2%.
• 8.8% of large companies had one in the past year, against 5.0% of small and medium firms.
• 14.8% said they don't know whether they have had one.

Some companies in the survey blamed AI-assisted attacks, and smaller firms said they can't afford proper security. Entertainment companies are an obvious target: they hold millions of customer emails, and fans keep their accounts for years. The industry has been here before. The 2024 ransomware attack on Kadokawa took Niconico offline for about two months. This month's attacks show how little has changed since. Here's how I see it.

Kairo's Take

The more than 11.7 million figure in the headline sounds terrifying, but thankfully payment info and customer passwords weren't actually dumped in this Capcom ID hit. What sucks is having over 11 million emails, IP addresses, and login metadata out in the wild, which just guarantees a massive incoming wave of targeted phishing scams pretending to be official Capcom security alerts. Beyond forcing mandatory log-in accounts for games that really don't need them, it's just another reminder to stay vigilant with your inbox after any major publisher breach.

For more on the business side, read our Comic CMOA hack explainer, how anime studios make money and anime's AI controversies in 2026, or browse all our industry news.

Sources: Capcom, notice of October 22 and update of October 23, Anime News Network, Papyless (Renta!, Japanese), Dai Nippon Printing (honto, Japanese), Trend Micro (incident count, Japanese), Teikoku Databank (company survey, Japanese), Animenomics. Store notices from the Animate, Melonbooks and Gamers sites, checked October 23, 2026. Cover photo: Capcom headquarters in Osaka by Tokumeigakarinoaoshima, via Wikimedia Commons, CC BY-SA 4.0, cropped.