# Eleven million emails and forty-three birthdays

2026-10-22

Capcom says 11,774,247 CAPCOM ID rows left worldwide: email and system identifiers. Forty-three of those also have date of birth, gender, region, and nickname. One hundred and ninety-six passwords were changed by the attacker. User passwords were not in the confirmed leak. Games still run.

Canonical: https://www.fabiocti.com/notes/eleven-million-emails-and-forty-three-birthdays/
Author: Fabio Correia

The headline is 11.7 million. The birthday count is 43.

Capcom said CAPCOM ID was reached. It saw traces on 19 October, confirmed the access the same day, and stood up a response cell on the 20th. Today’s field list, as of this notice: 11,774,247 rows worldwide with email and system identifiers — created-at, last login, login count, last-login client address. Of those, 43 also have date of birth, gender, country or region, and nickname. Cards are not in it. The company has not confirmed that user-set passwords left.

It has confirmed that 196 of the 11.7 million had their login password changed by the attacker. Those 196 have been reset. The games, it says, still play. CAPCOM ID services are still up. Police and the Personal Information Protection Commission were told yesterday.

## What 11.7 million will be asked to cover

It will be briefed as every Capcom birthday on earth. Forty-three rows have a birthday. It will be briefed as a password dump. The notice says the opposite of that sentence, and then adds 196 accounts that were rewritten. A rewritten password is a hijack. It is not 11.7 million passwords in a file.

If you have a CAPCOM ID, the email is exposed. The 196 will already have been kicked. A mail that asks the rest of the 11.7 million to “confirm the birthday leak” is someone else. A still-running game is evidence about the title server. It is not evidence about the email that left.

Eleven million is an address book with login metadata. Keep the forty-three in a different sentence.