Security Guides
SourceNext Member Data Leak (22,519,960 Records): Emails, Passwords and Addresses May Be Exposed — What Members Should Do
Unauthorized access to SourceNext's member data system may have exposed 22,519,960 records, including emails, passwords and addresses (announced October 15, 2026). What was involved and what members should do.
For: anyone who has registered as a SourceNext member, and anyone who runs a service that holds member data. This article is based on the official notice and FAQ from SOURCENEXT CORPORATION, a Japanese software company, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 17, 2026Not yet known
- Number of people (the notice gives only a record count)
- Details of the vulnerability and the outcome of the outside third-party investigation (in preparation, per the FAQ)
- How passwords were stored (encrypted or hashed)
- Whether the leaked data has been misused
The company says it is investigating the cause and scope with outside specialists and will promptly announce any new facts on its website and elsewhere. On October 16 it added an update about password resets.
What SourceNext members should do today
Check whether you are affected (registered by 13:36 on October 13)
According to the company's FAQ, the scope covers people registered as members by 13:36 on October 13, 2026. From October 15, people who may be affected have been receiving emails in stages at their registered address. People with no registered email address are to be contacted by letter.
If you have ever registered with SourceNext, take the steps below even if no notice has arrived.
Change the password on other services that share it, first
Both email addresses and passwords are among the items that may have leaked. The company warns that a third party may try this pair to log in to other services, and asks members to change the password on any other service that uses the same combination.
How passwords were stored (whether encrypted or hashed) has not been disclosed. The company has disabled the old SourceNext passwords, but on other services they still work. Start with email, online shopping and financial services. A password manager is the practical way to stop reusing passwords, and two-factor authentication makes a known password far less useful to an attacker.
Set a new SourceNext password through the official website you open yourself
In its October 16 update the company said every member's password has already been changed and the old passwords can no longer be used. When you log in, the screen guides you through setting a new password.
The reset site is overloaded and hard to reach, and the company asks members to try again after a while. Do this through the official website you open from a bookmark or search, not through a link in an email or text. Do not reuse a password from another service.
Watch for emails, texts, calls and letters claiming to be SourceNext
The company warns that the data may be misused for suspicious emails (phishing emails), text messages, calls and letters pretending to be the company or its partners. It asks members not to open links or attachments in unexpected emails or texts, and not to enter personal data or passwords on suspicious websites.
Company name, job title and department are also among the items. If you registered with a work address, be careful with messages to your workplace about "software updates" or "licence checks" as well.
For questions, use the dedicated contact listed in the official notice
The notice lists a dedicated line for this incident, 0120-035-116 (toll-free in Japan, 10:00 to 18:00 including weekends and holidays), and an enquiry form linked from the notice page. According to the FAQ, requests to close an account are also handled there. Check the number on the official notice through a website you open yourself; do not use numbers or links from messages you receive.
What happened (according to SourceNext)
The following is based on the company's notice of October 15, 2026 (including the October 16 update) and its FAQ (checked on October 17).
Oct 9, 2026 (Fri), around 10:00
A third party began unauthorized access and misused a member data retrieval API to obtain member data (found in the later investigation).Oct 13 (Tue), around 9:00
Unauthorized access to the system that manages member data was confirmed. Emergency measures, including blocking unauthorized outside traffic, were taken.Oct 13 (Tue), by 13:36
Containment completed. Monitoring continues, and no unauthorized access has been found since, the company says.Oct 15 (Thu)
Reported to Japan's Personal Information Protection Commission and published the notice. Emails to affected members began, in stages.Oct 16 (Fri)
Update added on the overloaded reset site and the fact that all passwords had been changed. The notice said a damage report would be filed with the local police that day (the FAQ says the company consulted the local police that day).
- Affected system
- The company's system for managing member data
- Count
- 22,519,960 records. The notice gives records, not a number of people
- Scope
- People registered as members by 13:36 on October 13, 2026 (FAQ)
- Items
- Email address, password, name, name in katakana, address, gender, phone number, fax number, date of birth, company name, job title, department, system identifiers (subscribed services, registration date, login date and so on). Not every item for every member; items differ by registration
- Passwords
- Storage format not disclosed. The company says all passwords have been changed and asks members to set a new one
- Not included
- Credit card data (not stored in the affected system). The company says it does not collect ID documents at registration
- Route
- A third party misused a member data retrieval API. The vulnerability that caused it has been fixed (FAQ); details not disclosed
- Reports
- Personal Information Protection Commission on October 15. Local police on October 16 (the notice says a damage report was planned; the FAQ says the company consulted the police)
Email + password
Change other services using the same pair; reset SourceNext through the official site
Name, address, phone, birth date
Do not use links or numbers in emails, texts, calls or letters claiming to be the company
Company, job title, department
If you registered with a work address, watch for fake messages to your workplace
What is known and what is not
Status as of October 17, 2026. When the company publishes more, the status column will be updated.
| Item | What the notice says | Status |
|---|---|---|
| Data leaving the company | Members' personal data was found to have leaked outside (the FAQ says it "likely" leaked) | Leak confirmed (company) |
| Count | 22,519,960 records (no number of people given) | Possible (company) |
| Scope | People registered by 13:36 on October 13 | Confirmed (company) |
| Items | Email, password, name, name in katakana, address, gender, phone, fax, birth date, company, job title, department, identifiers (vary by member) | Possible (company) |
| Password storage | No mention of encryption or hashing | Not stated |
| Credit card data | Not stored in the affected system | Not included (company) |
| Period of access | From around 10:00 on October 9 until containment by 13:36 on October 13 | Found (company) |
| Route and cause | Misuse of a member data retrieval API; the vulnerability has been fixed; details not disclosed | Under investigation |
| Access after containment | None found since containment | Not found (company) |
| Misuse of leaked data | Not mentioned in the notice | Not stated |
| Passwords | All changed; old passwords no longer work (October 16 update). The FAQ says resets are being carried out "in stages" | Changed (company, October 16 update) |
| Individual notices | Emails in stages from October 15; letters planned for people without email | In progress (company) |
Reading note: records are not people
The figure in the notice is a record count, not a number of people. Where one person has several registrations, for example, the two will differ. This article will be updated if a number of people is published. Also, credit card data is the only item the notice explicitly says is not included. Do not read items missing from the list as "not leaked".
What the combination of items can be used for
In general, these combinations enable the following kinds of misuse. This does not mean it has happened in this case.
- Email + password: tried on other services that use the same pair (known as credential stuffing)
- Name + address + phone + email: convincing "apology" or "please reset" messages with the right name and address, including fake letters
- Company + job title + department: material for fake work messages pretending to be a vendor or supplier
- Birth date + identifiers such as registration date: material for impersonating you on the phone. Being able to state these is not proof of identity
To check whether a password has leaked, see How to check if your password was leaked; to look for unfamiliar sign-ins, see How to check if someone accessed your account.
In a past case, the Bookoff member data leak of October 2026, the first report's "up to about 6.43 million records (member numbers)" was settled in the second report as a number of people (6,383,279). That may or may not happen here.
This site's view: disabling old passwords does not protect the other places you reused them
Because the company says it has changed every member's password, the leaked passwords are much less useful for logging in to SourceNext itself. Other services that share the same password are outside that measure. Even while the reset site is hard to reach, you can change reused passwords elsewhere today. Do it in that order: other services first.
For operators of services that hold member data: watch the volume your member-data APIs return
The company has not disclosed details of the vulnerability, so this section does not cover how to prevent the intrusion. Two things can be said from the published sequence: a function for pulling member data (an API) was used, and about four days (this site's calculation from the notice's times) passed between the start of access (around 10:00 on October 9) and its confirmation (around 9:00 on October 13). The steps below are limited to what you can decide in advance for your own service. This section is not an assessment of the company's response.
Set an hourly cap and an alert for every API that returns personal data
In general, with or without authentication, a member-data API should rarely return large numbers of members to one user or one source in a short time. Set a cap on how many members each API may return per hour, and alert someone at 80% of it, so that unusual extraction is easier to notice early.
There are three places to measure: inside the application (log how many records were returned), in front of it (rate limits at a reverse proxy or CDN), and in your cloud audit logs (alerts). Practical settings are in Rate limiting and abuse control.
Prepare the reset path before you disable everyone's password
Disabling every member's password after a leak sends a rush of people to the reset screen in a short time; here, too, the company announced that its reset site was overloaded. You can decide in advance to scale the reset screen separately from the main service, and prepare wording for busy periods ("try again later", "change other services first").
Also check that passwords are stored with a slow, password-specific method (bcrypt, Argon2 and the like) with a salt. The storage method shapes what you will need to ask of users after a leak (What is password hashing?).
Sources (public record)
The facts in this article are based on the public sources below. We have not speculated about the undisclosed vulnerability or methods. No disclosure on this incident was found in the Tokyo Stock Exchange's timely disclosure system (TDnet) for October 13 to 17, 2026 (checked October 17).
- SOURCENEXT CORPORATION, "当社サイトへの不正アクセスによるお客様情報流出のお詫びとお知らせ" (Apology and notice regarding the leak of customer information due to unauthorized access to our site; October 15, 2026, updated October 16) — sourcenext.com
- Same company, "情報漏洩に関するよくあるご質問" (FAQ on the data leak; undated, checked October 17, 2026) — sourcenext.com
Update history
2026-10-17: First version, based on the company's notice of October 15 (including the October 16 update) and its FAQ (checked October 17). The number of people, details of the vulnerability and the password storage format have not been disclosed; this article will be updated when they are.
Read next
- Member data cases from the same period: Bookoff member data leak / The Gyazo breach
- Passwords: How to check if your password was leaked / Choosing and using a password manager
- Follow-on scams: What is phishing?
- Other incidents in 2026: Data breaches and cyberattacks list (Japan and worldwide)
FAQ
QWhat leaked from SourceNext?
According to SOURCENEXT CORPORATION's notice of October 15, 2026, the data that may have leaked is email address, password, name, name in katakana, address, gender, phone number, fax number, date of birth, company name, job title, department and system identifiers (subscribed services, registration date, login date and so on). The count is 22,519,960 records. This is the full list of items that may have leaked; not every item leaked for every member, and the items differ by how each member registered, the company says.
QAm I affected?
According to the company's FAQ, the scope covers people registered as SourceNext members by 13:36 on October 13, 2026. From October 15 the company has been emailing people who may be affected, in stages, at their registered address. People with no registered email address are to be contacted by letter. If you have ever registered with SourceNext, take the steps in this article even if no email has arrived.
QWere passwords or credit cards leaked?
Passwords are among the items that may have leaked. How they were stored (whether encrypted or hashed) has not been disclosed. In its October 16 update, the company said every member's password has already been changed and the old passwords can no longer be used, and asked members to set a new one. It also asks anyone using the same email and password on other services to change those as well. Credit card data is not stored in the affected system and is not included (company); the company says there is no need to stop or reissue cards.
QWhat caused it?
According to the company, a third party began unauthorized access at around 10:00 on October 9 and misused a member data retrieval API (a function used to pull member information) to obtain the data. Its FAQ says the system vulnerability that caused it has been fixed. Details of the vulnerability have not been disclosed. The company says it is investigating with outside specialists.
QWhat if I get an email or text message claiming to be from SourceNext?
The company warns that the data may be misused to send suspicious emails, text messages, calls and letters pretending to be the company or its partners. It asks members not to open links or attachments in unexpected emails or texts, and not to enter personal data or passwords on suspicious websites. Set your new password through the official website you open yourself from a bookmark or search, not from a link in a message. For questions, use the dedicated line listed in the official notice (0120-035-116, toll-free in Japan).
QI cannot reset my password. What should I do?
In its October 16 update, the company said the password reset site is overloaded and hard to reach. Since every member's password has already been changed and the old ones no longer work, it asks members to wait a while before setting a new password. In the meantime, change the password on other services that share it.