SourceNext Security Review: 22.5 Million Member Records Exposed Through API Abuse

SourceNext security review focuses on the October 2026 incident in which the Japanese software company disclosed unauthorized access to its member information system. Attackers exploited a retrieval API, potentially exposing records for 22,519,960 users. The event ranks among the largest disclosed breaches in Japan that year.

SourceNext Breach Timeline and Technical Details

Unauthorized access began around 10:00 a.m. on October 9, 2026. The company detected the activity at approximately 9:00 a.m. on October 13. Containment measures, including blocking external communications, were completed by 1:36 p.m. the same day. No further unauthorized access occurred after that point.

The attack targeted the member-information retrieval API. Exposed fields included email addresses, encrypted passwords, names with kana readings, addresses, gender, phone and fax numbers, birth dates, and optional details such as company information or subscribed services. Credit card data was stored separately and remained unaffected. Not every record contained all fields.

Passwords were stored in encrypted form, though reports indicated the decryption program itself was compromised during the incident. The company invalidated passwords for affected accounts and required resets upon next login. SourceNext maintains over 20 million registered users historically and sells security software alongside products such as the Pocketalk translator device.

Company Actions and User Recommendations

SourceNext reported the incident to Japan’s Personal Information Protection Commission on October 15, 2026, and planned a police report the following day. External security experts were engaged for investigation and system review. A dedicated inquiry hotline (0120-035-116) operates from 10:00 to 18:00 daily, and affected users receive sequential notifications by email or mail.

The company advised users to change SourceNext passwords immediately and to update any reused credentials on other sites. It warned of potential phishing attempts using exposed email and password combinations. Services remain operational after containment, with ongoing monitoring in place.

Users should verify all SourceNext communications through official channels and avoid clicking links in unsolicited messages. No widespread misuse of the data had been confirmed in reports available as of October 20, 2026. The investigation continues into the exact volume of data taken and whether passwords were decrypted.

Comparing SourceNext Incident to Prior Company Events

SourceNext experienced an earlier breach in 2023 that affected roughly 121,000 customers of its online store and included credit card information. The 2026 incident differs in scale and vector, involving API abuse rather than direct store access. It also exceeds the 2023 event by more than 180 times in potential records exposed.

Founded in 1996 and listed on the Tokyo Stock Exchange, SourceNext positions itself as a provider of security products. The 2026 disclosure drew attention to the irony of a security software seller facing a large-scale member data compromise. The company has committed to fundamental reviews of security monitoring and data management practices.

Practical steps for affected individuals include monitoring accounts for unusual activity, enabling multi-factor authentication where available, and using unique passwords across services. SourceNext continues to publish updates on its official support pages as new information emerges from the ongoing investigation.