Capcom Reports Breach Affecting 11.7 Million Users; Square Enix Also Hit
Capcom said passwords were changed on roughly 196 accounts, while Square Enix traced its Final Fantasy XIV incident to credentials stolen elsewhere.
Capcom disclosed a direct breach of its databases and services that exposed system-identifying account information and email addresses belonging to more than 11.7 million users, the company said on October 19. In the same round of disclosures, Square Enix confirmed that a number of Final Fantasy XIV accounts had been accessed by an unnamed third party, according to kotaku.com.
Square Enix said the Final Fantasy XIV access came from credentials gathered in breaches at other companies rather than from a direct breach of its own databases. Capcom, by contrast, reported that the incident was a direct intrusion into its own systems.
Capcom said user information including date of birth, gender and location was accessed in at least 43 cases, and that passwords were illegally changed in roughly 196 accounts. The company said the vulnerability was fixed internally and that it has handed its investigation findings to police.
Neither company named the third party behind the activity, and Capcom did not specify how the intrusion was carried out.
In recent weeks, Japanese companies have seen a surge of AI-powered cybersecurity breaches, and cases in 2026 have already surpassed the total for all of last year, according to the article. The Japanese government is looking into methods to address the growing number of breaches.
Quick answers
How many users were affected by the Capcom breach?
Capcom said account information and email addresses of over 11.7 million users were exposed in a direct breach of its databases and services.
Were Final Fantasy XIV accounts breached directly?
Square Enix said the account access came from credentials gathered in breaches of other companies, not from a direct breach of its own databases.