SOURCENEXT , a prominent Japanese software distributor, has disclosed a data breach in which an internal member information query API was abused by unauthorised actors. The incident is believed to have compromised up to 22,519,960 customer records, including registered email addresses, account passwords, legal names, physical addresses, and telephone numbers. Sourcenext states that while data fields vary by profile, it has proactively reset all customer passwords as a precaution.
Internal audit logs show the first signs of unusual network traffic on 13 October, with rogue connections only being cut four hours later. Forensic work indicates the intrusion began earlier, with attackers conducting automated API queries from 9 October and continuing in large batches for four consecutive days. The company notified the Personal Information Protection Commission of Japan and engaged external forensic investigators to assess the breach’s architecture.
The advisory outlines a wide range of exposed data, including email addresses, account passwords, kana names, postal addresses, and birth dates, among others such as corporate affiliations and telephone numbers. While the advisory does not confirm whether passwords were salted and hashed, the article notes that plaintext storage cannot be ruled out, highlighting a serious risk of credential stuffing across other sites if passwords were reused.
Sourcenext recommends affected customers review their credentials, change duplicate passwords across online accounts, and consider password managers to create unique credentials as a practical defence against future breaches.