Capcom Breach Exposes 11.7M Accounts; Square Enix Hit Too
Capcom says attackers directly accessed user databases, exposing identifying details and emails for over 11.7 million users, while Square Enix says Final Fantasy XIV accounts were entered with credentials leaked elsewhere.
Merhabyte Haber Merkezi · · 2 min read
Services run by Capcom and Square Enix have been hit by unauthorized-access attacks carried out by third parties. The incidents are being described as part of a wave of cyberattacks on Japanese companies in recent weeks, many of which are said to be AI-assisted.
The two companies' statements differ on the nature of the attacks. Square Enix says its own systems and databases were not directly attacked, whereas Capcom says attackers gained direct access to databases and services holding user information.
Square Enix: leaked credentials from other breaches
Square Enix confirmed on October 19 that an unnamed third party had accessed some Final Fantasy XIV accounts. According to the company, the access did not result from a direct breach of its security systems or databases. It said the third party used credentials harvested in security breaches at other companies to log in to the accounts.
Square Enix has already cut off access to accounts it believes may have been compromised. It warned that if such incidents continue to rise, it may impose mandatory password resets and additional security measures across all accounts.
Capcom: data on 11.7 million users accessed
Capcom said in a statement yesterday that a direct breach had occurred in the databases and services that hold user information. According to the company, identifying account details and email addresses belonging to more than 11.7 million users were accessed.
More sensitive data affected far fewer accounts. In at least 43 cases, attackers reached information such as date of birth, gender and location. In roughly 196 accounts, passwords were illegitimately changed. Capcom said the breach took place on October 19 and that the vulnerability was closed internally right away. An investigation into the cause is under way, and all findings have been passed to the police.
Attacks on Japanese companies are mounting
What Capcom and Square Enix experienced is not the only incident Japanese companies have faced in recent weeks. The Japanese government is reportedly looking for ways to counter a surge in breaches affecting companies in every sector. The number of breach cases recorded in 2026 has already exceeded last year's total, and many of the attacks are said to be run with AI systems.
The incidents also serve as a reminder of standard security advice. Users are urged not to reuse the same password across multiple services and to change passwords regularly. Where a service supports it, two-factor authentication should be switched on, making it harder for data leaked from one company to be used to break into other accounts.
