Illustration of the idea in the article: two breach notices read with the same list of questions. Conceptual. The logos are shown for identification and the picture claims nothing beyond the article.
Two breach notices in one week, from a game company and a bank. The same six questions show what each one confirms, what it does not, and what you should do.
The headline number is rarely the number that matters
A breach notice tells you what the company has confirmed so far, in the words its lawyers chose, and the gaps are part of the message.
In the week of 19 October 2026, two organizations disclosed that customer data had been taken. Capcom, the Japanese game maker, reported unauthorized access to its CAPCOM ID account system. State Bank of India, SBI, told its stock exchanges in a filing on 21 October that it had experienced “an incident involving the loss of certain data.”
This article is for anyone who gets a breach email, supports people who do, or has to write one someday. It uses these two notices to teach six questions that work on any notice. It does not tell the story of an attack, because neither organization has said how the attack happened.
Question 1: What is being counted?
Capcom says 11,774,247 records worldwide had email addresses and some system identifiers exposed. Some news headlines turned that into 11.7 million accounts.
A record is one row of data, such as one account. It is not always one person, because one person can hold several accounts. The numbers are close, but they are not the same thing.
SBI shows the same problem in a different shape. Its filing says a preliminary analysis of about 375,000 records available on the dark web found 3,897 customer records containing personal information.
The 375,000 is roughly the size a criminal seller advertised. The 3,897 is what the bank says it has identified so far. They answer different questions, and neither tells you how many people are affected.
Question 2: Which fields were taken?
The field list tells you the risk, so read it slowly. Capcom lists email addresses, account creation time, last login time, login count and the network address used at the last login. For 43 records it also lists date of birth, gender, country or region, and nickname. Capcom says credit card information is not included.
SBI’s filing says the exposed information “reportedly included” names, registered mobile numbers, dates of birth, gender, email and home addresses, branch and customer (CIF) identifiers, lead IDs, and metadata about loan and lead records. It does not list account numbers, balances, passwords or card details. That is a reassuring absence, but a name, a phone number and a loan detail are plenty for a convincing phone call. Capcom itself warns that the data could be used in phishing emails that pretend to be Capcom.
Question 3: Was data read, changed, or both?
Capcom says passwords were changed without authorization on 196 accounts, and that it has reset them. It says it has not confirmed any leak of passwords that customers set. Those are two separate facts, and the notice keeps them apart.
Our reading is that changing a password means the intruder could write to the account system, and not only read from it. Capcom does not say that. It is an inference from the fact, and a good reason to ask what else the access allowed.
Question 4: When did it start and when was it found?
Notices usually give a detection date and are quiet about the start. Capcom says it found suspicious activity on 19 October, set up a response team on 20 October, told the police and Japan’s data protection regulator on 21 October, and published its statement on 22 October. It does not say when the attackers first got in.
SBI’s timeline is shorter on detail and different in kind. SBI’s filing says the bank received alerts on 16 October from three senders, its threat intelligence provider, the Defence Cyber Agency and CERT-In, about the suspected exposure of customer data on the dark web, and it filed its disclosure on 21 October. When the data left the bank, if it did, is not stated. Time between the leak, the first alert and the notice is time in which the data can be misused.
Question 5: What is said about the cause?
Neither organization has disclosed how the intruder got in. Capcom says it identified the attack method and responded, but does not describe it. SBI has named no cause, and its filing does not say whether the data came from the bank, a vendor or someone else. This is normal early in an investigation.
It also means any article that names a cause is guessing.
SBI’s own filing calls it a “suspected exposure” and an “alleged compromise,” and says a detailed investigation was required to establish whether the data is authentic and complete.
Be especially careful with claims made by the criminals themselves. A seller says they have extra documents from SBI. Nobody has confirmed that, so we do not repeat the details. Advertising a breach is part of how these sellers earn money.
Question 6: Who is the notice written for, and what does it ask you to do?
Capcom’s statement is written for customers. It says affected people will be contacted individually in stages, it lists support channels by region, and it tells people not to open links or attachments in unexpected messages.
SBI’s filing is written for investors and regulators. It says the incident has no material impact on the bank’s core business operations, financial performance or business continuity, and that the bank has engaged an independent cybersecurity agency empanelled by CERT-In, India’s national computer emergency response team.
The filing does not say whether affected customers have been or will be told. The Internet Freedom Foundation, an advocacy group, argues that this is a gap. The bank may have communicated through other channels.
The six questions side by side
| Question | Capcom | SBI |
|---|---|---|
| What is counted? | 11,774,247 records. People not counted. | About 375,000 records on the dark web, per the filing (the size a seller advertised). 3,897 that the bank says contain personal data. |
| Which fields? | Email, account dates, login count, last login address. Birth date, gender, country, nickname for 43 records. | Name, mobile number, birth date, gender, email, address, customer (CIF) and branch identifiers, lead IDs, loan and lead metadata. |
| Read or changed? | Read, and passwords changed on 196 accounts. | Reported as data loss. Not stated further. |
| Start and detection? | Detected 19 October. Start not stated. | Alerted 16 October. Disclosed 21 October. Start not stated. |
| Cause? | Method identified, not disclosed. | Not disclosed. |
| Who is it for? | Customers, with support channels and staged contact. | Investors and regulators. Customer contact plan not stated in the filing. |
What to do if you are a customer
The advice from both situations is the same, and it is not exotic. Assume that a message using your real details may be a trap. Do not click links or open attachments in unexpected messages, even if they mention your account correctly. Go to the company’s official site or app by typing the address yourself, and use the contact channels the company has published.
If you use the same password on other sites, change it. Where a site offers a passkey or an authenticator app, turn it on. If you hold an account at either organization, watch for official contact from them and treat anything else with suspicion.
What to do if you run a team
Look at the six questions as a checklist for your own incident notice. Count people as well as records, and say which you mean.
List the fields in plain words, and name each one, including network addresses. Say what you do not know, and say when you will update. Write a version for customers, not only for lawyers and regulators.
How deeply should you learn this?
Know: Everyone should know that a headline number and a field list answer different questions, and that “no evidence of” is weaker than “did not happen.” Read the field list before you read the reassurance.
Use: Support, helpdesk and security staff should be able to read a notice, explain it to a customer, and tell the difference between confirmed facts, company claims and criminal claims.
Master: Incident leads and communications owners should design notices before they are needed. That means agreeing who counts what, how fields are described, how updates are published, and how customers are told.
What you can ignore for now
You do not need to track the names of the groups or forums that sellers use. They change every month, and chasing them adds risk and little understanding. Read the notice, not the seller’s advertisement.
A practical next step
Find the last breach notice you received, or open Capcom’s statement, and answer the six questions in your own words. Write down what the notice does not say. That list is your guide to what to watch for next.
Go deeper
- Capcom: statement on unauthorized access to CAPCOM ID, 22 October 2026, for the counts, dates and support channels.
- Capcom: English translation of the statement, for readers who do not read Japanese.
- BleepingComputer on the Capcom breach for a summary of the statement.
- SBI: filing to BSE and NSE, Incident involving Data Loss, 21 October 2026, for the bank’s own words.
- The Hacker News on the SBI data leak for the reported filing contents.
- CyberPeace on the SBI leak for what is known and unknown.
- Internet Freedom Foundation on the SBI filing for an advocacy group’s critique of what the filing leaves out.
- Related reading on this site: Phishing Attacks and Social Engineering Attacks.
Facts in this article were checked on 26 October 2026. Both investigations are ongoing, so figures may change. SBI details come from its 21 October 2026 filing to the stock exchanges and from reports on it.