SourceNext: up to 22.5 million records potentially exposed, passwords included
SourceNext said unauthorised access to its member system may have exposed up to 22,519,960 records, including email addresses and passwords, and it is requiring affected members to reset their passwords.
What happened
SourceNext, a Japanese software and security-products company, said a third party gained unauthorised access to its member information management system through an API used to retrieve member information. The access began around 10:00 a.m. on October 9, 2026; an employee noticed unusual activity around 9:00 a.m. on October 13, and the company completed emergency measures blocking the access by 1:36 p.m. that day. SourceNext announced the incident on October 15 and says no further unauthorised access has been confirmed since the block. It reported the incident to Japan's Personal Information Protection Commission on October 15 and is investigating with outside specialists.
Who is affected
Up to 22,519,960 member records may have been exposed — the company describes the leak as potential, and the fields involved vary by member. They can include email addresses, passwords, names and their phonetic readings, addresses, gender, phone and fax numbers, dates of birth, company names, job titles and departments, subscribed services, registration and login dates, and other system identifiers. Credit card information was not stored on the affected system. The forced password reset applies to members registered as of 1:36 p.m. on October 13, 2026.
How serious
The concrete risk is account takeover elsewhere: email address and password pairs can be tried automatically against other services, and any account where the same password was reused is exposed. Names, addresses, phone numbers and dates of birth also support targeted phishing by email, text, call or post that uses real details to look genuine. The exposure is potential rather than confirmed — SourceNext says the data may have leaked — but its decision to require password resets for all affected members reflects that risk.
What to do now
If you have a SourceNext account, complete the password reset the company requires and choose a password you do not use anywhere else. Change any other account where you used the same email and password combination. Treat unexpected messages that cite your real details and urge you to sign in or pay as suspect, and reach SourceNext only through its official site or app.
Sources: BigGo Finance · Reuters via TradingView (Kyodo)