SaaS Security Risks Highlighted by SourceNext Data Breach of 22.5 Million Records

SourceNext, a Tokyo-listed software firm, confirmed that attackers abused its member information retrieval API to access customer records over four days in October 2026. The incident affected up to 22,519,960 accounts and ranks as the second-largest disclosed corporate breach in Japan this year. No credit card data was stored in the compromised system.

SourceNext Breach Timeline and Exposed Data

Unauthorized access started around October 9 at 10 a.m. JST and continued until detection on October 13 at 9 a.m. The company blocked external communications by 1:36 p.m. the same day. Public notice followed on October 15, with notifications sent to affected users via email and mail.

Exposed fields varied by record but included email addresses, encrypted passwords, names in kanji and kana, addresses, phone numbers, birth dates, gender, and employment details where provided. Passwords were stored in encrypted form rather than hashed, and reports indicate the decryption tool was also accessed. The company reset all affected passwords and required users to create new ones on next login.

SourceNext notified Japan’s Personal Information Protection Commission on October 15 and planned a police report the following day. An external forensic review remains underway to determine the full scope and root cause.

Implications for SaaS Security Risks and Data Protection

API abuse remains a recurring vector in recent Japanese incidents, and the SourceNext case underscores gaps in access controls and monitoring that affect many SaaS products. Encrypted passwords still created exposure once the decryption program was reached, showing that encryption alone does not eliminate risk if supporting systems are also compromised.

Users registered before October 13, 2026, should treat the event as a direct reminder to avoid password reuse across services. SourceNext services themselves were confirmed operational after containment, but the company continues system-wide checks with outside experts.

Businesses evaluating SaaS platforms can apply the same questions raised here: whether stored credentials use modern hashing, whether API endpoints enforce strict rate limiting and logging, and whether breach notification procedures meet regulatory timelines. No compensation program has been announced yet.

Practical Steps After the SourceNext Incident

Change the SourceNext password immediately if you have not already done so. Review any other accounts that used the same or similar credentials and update them. Enable two-factor authentication wherever available and monitor email and phone for phishing attempts that may reference the breach.

SourceNext maintains a dedicated support line at 0120-035-116, open 10 a.m. to 6 p.m. JST daily including weekends. Users without email on file will receive mailed notices in sequence. Continued updates from the company and regulators are expected as the investigation progresses.