Short answer
SourceNext, the Japanese software seller, said on 15 October 2026 that a third party misused its member information API and may have taken 22,519,960 records. The company says credit card data was not stored in the affected system.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | SourceNext Corporation |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Software retail |
| Country | Japan |
| Detected | 2026-10-13 |
| Disclosed | 2026-10-15 |
| People or records affected | Up to 22,519,960 member records, as stated by the company |
What data was exposed
- Email address (login ID) and password
- Name and katakana name
- Address, phone and fax numbers
- Date of birth and gender
- Company name, job title and department
- Service identifiers, registration date and login date
What happened
SourceNext sells PC software and apps in Japan. On 15 October 2026 it told members that someone had abused its member information retrieval API to pull customer data. The company’s own timeline puts the first unauthorized access at about 10:00 on 9 October. It confirmed the activity at about 09:00 on 13 October and said it had contained it by 13:36 that day.
The count is large: 22,519,960 records. SourceNext stresses that this is the number that may have been taken, and that not every person had every field stored. What was held depends on how each customer registered.
The password question
The most serious detail is the password. Most breach notices say passwords were hashed. Here, INTERNET Watch reported that SourceNext later confirmed the leaked passwords were not encrypted. The company says it has reset them. @IT, in its own report, said it could not tell from the notice how the passwords were stored. We treat the plaintext report as a claim from one outlet that the company has not repeated on the page we read.
Either way, anyone who reused their SourceNext password on another service should change it at once. See our guide on what to do after a data breach for the order to work in.
How the company responded
SourceNext says it blocked the outside communication, saw no further access after containment, and brought in an external forensic firm for an emergency check of all systems. It plans to overhaul its security and monitoring. It reported the incident to Japan’s Personal Information Protection Commission and planned a police report on 16 October. @IT’s coverage noted heavy traffic on the login site as users rushed to change passwords.
Scam risks to expect
The data set is unusually useful to scammers. It combines a real email, a name, an address, a birth date and, for some, an employer. That makes convincing phishing easy. Read our notes on phishing messages and online shopping scams, and keep an eye on government impersonation scams as follow-up calls often claim to be an official body.
What is still unknown
The company has not said how the attacker found the API weakness, whether the data has appeared for sale, or how many former members are in the count. Check our breaches index for updates, and see our editorial policy for how we label claims.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Credential stuffing: attackers try the leaked email and password pair on shopping, email and banking sites if you reused the password.
- Phishing emails and SMS that copy SourceNext, with a fake password reset link.
- Phone calls using your name, address and birth date to sound like a software vendor or support desk.
- Fake software renewal or license notices aimed at registered customers.
What to do if you are affected
- 01Log in to your SourceNext account and set a new password. The company forces a reset at login.
- 02Change the password on every other site where you used the same email and password, starting with email, banking and shopping.
- 03Turn on two-step verification wherever it is offered, and use a password manager for new passwords.
- 04Do not click links in emails or SMS that claim to be from SourceNext. Go to the site by typing the address yourself.
- 05Report suspicious calls to the police consultation line #9110 or the consumer hotline 188, and phishing messages to the Council of Anti-Phishing Japan.
Frequently asked questions
Was my SourceNext password leaked?
The company lists passwords among the fields that may have been taken. INTERNET Watch reported that SourceNext later confirmed the leaked passwords were readable, not encrypted, and that it has reset them so the old ones no longer work for SourceNext ID.
Were credit card numbers exposed?
SourceNext says card data was not stored in the affected system, so it was not part of this incident.
How do I know if I am one of the 22.5 million?
The company said it will email affected members at the address on file. Any account registered with SourceNext should be treated as exposed until you hear otherwise.
Is the 22.52 million figure confirmed theft?
No. The company describes it as the number of records that may have been leaked. Different outlets round it as 22.51 or 22.52 million, but all point to 22,519,960.
What should I do if I used the same password elsewhere?
Change it everywhere now. Attackers run leaked email and password pairs against other services within days.
Sources
- Notice about unauthorized access (SourceNext support page, Japanese), SourceNext, 2026-10-15
- ソースネクスト、会員情報最大約2252万件がパスワード含め漏えい (SourceNext reports up to about 22.52 million member records, including passwords, leaked), INTERNET Watch, 2026-10-16
- ソースネクストで2251万件超の情報流出 (Over 22.51 million records leaked at SourceNext), @IT, 2026-10-17
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.