Attackers took email addresses and login metadata for 11,774,247 CAPCOM ID records, then quietly changed passwords on 196 accounts.