Security seller SourceNext: attackers may have taken up to 22,519,960 member records through its own member-data API, open four days. I run AliasFleet, email aliases: one per site, so a leak names its source and you can kill it. Nikkei: the decryption program was hacked. Trust sold, not operated. Now it is telling 22.5 million members their records may be in someone else's hands.
What the notice actually says
The disclosure landed on 15 October, covered by Nikkei, Impress Watch, Reuters, Sankei, Jiji and ITmedia. SourceNext sells PC software and security products, including its Pocketalk translators. Its own official notice sets out the timeline and the response. The scale is the point: 22.5 million records at risk, with email addresses and passwords in the same set. No screenshot of the notice appears in this article because the browser capture sandbox cannot render Japanese glyphs legibly.
| Confirmed | Still unconfirmed |
|---|---|
| SourceNext announced the incident itself on 15 October | Whether the attacker actually copied the full 22.5 million records, or how much was taken |
| Unauthorised access from around 10:00 on 9 October, confirmed around 09:00 on 13 October, containment finished 13:36 on 13 October | Whether any passwords were actually decrypted or used |
| The vector: abuse of a member-information retrieval API | How the API abuse got past whatever authentication or rate limits existed |
| Up to 22,519,960 member records at risk | Whether the 22.5 million records mean unique people, or include duplicates |
| Data: email addresses, passwords, names, name kana, addresses, gender, phone numbers, fax numbers, dates of birth, company names, job titles, department names, system-specific identifiers | Whether the dataset has surfaced publicly or been traded |
| Credit card information was not stored on the affected system and was not leaked | Whether any secondary misuse has happened |
| Password reset required at login; users told to change reused passwords elsewhere | Who the attacker is; no attribution appears in any source |
| Report to Japan's Personal Information Protection Commission completed 15 October; police report planned for 16 October | Whether the planned police report has happened |
| No further unauthorised access confirmed after containment |
The field list is the full set of possibly leaked fields, not what every person lost. SourceNext says the affected items vary by registration status. One record might hold only an email address and a password. Another might hold the full identity file. And the count is records, not confirmed unique people. Treat 22.5 million as the size of the exposed file, and assume your record is in it if you ever registered with SourceNext.
Four days through one API
The vector here was not a stolen laptop. It was not a phishing email that fooled one employee. It was a member-information retrieval API, worked the wrong way, for four days.
An API like this exists so the company's own systems can pull up member records fast: look up an account, fetch its details, serve the next screen. Legitimate plumbing. The trouble with plumbing is that it does not care who turns the tap. If an attacker can reach the retrieval API and persuade it to hand over records it should not, the API does the copying at machine speed. No malware, no employee fooled into clicking something, just a function doing what it was built to do for the wrong caller.
Four days is the part that stings. Access began on the morning of 9 October. SourceNext confirmed it on the morning of 13 October and finished containment that afternoon. For four days a retrieval function could be abused. SourceNext has not said how the abuse got past its controls, and this piece will not guess. What the timeline does tell you is that the detection gap, not the break-in, set the size of this breach. A shorter gap would have meant a smaller file.
Earlier October breaches in Japan ran through vendors and contractor terminals. This one ran through SourceNext's own front door: an interface it built, exposed, and left reachable long enough for 22.5 million records to sit on the other side of it.
SourceNext says the data "may have leaked". That wording is careful, and it is not a reason to wait. If you registered with SourceNext, act as if your email address, password and identity details are in circulation. Acting early costs a password reset. Waiting costs finding out from a phishing email that already knows your name, your address and your job title.
Why the password detail matters
Passwords sit in the at-risk set, and that alone would make this breach serious. The detail that makes it worse comes from Nikkei, which reports that the passwords were stored encrypted but the program that decrypts them was also hacked.
It does not mean the passwords leaked in plaintext, and it does not mean they are safe because they were encrypted. Encryption holds only while the means of undoing it stays out of the attacker's reach. If the attacker reached the program that reverses the encryption, the encryption stops being a barrier. Whether the attacker actually used that program to decrypt anything is unknown. Nikkei's report says the program was hacked, not that passwords were decrypted or abused.
SourceNext itself has not described the encryption in its notice, so the Nikkei report is the only public source for this detail, and this article attributes it as such. The practical advice does not depend on resolving it. Encrypted, decrypted, or somewhere between, the only safe move is to treat every SourceNext password as exposed. That is exactly what SourceNext is doing: it requires a password reset at login and tells users who reused the same email and password combination elsewhere to change those passwords too. When a company that sells security products resets every password, believe it.
The reuse warning matters more than the reset itself. A leaked email and password pair is not just a SourceNext problem. Attackers feed stolen pairs into automated login attempts across other sites, a technique called credential stuffing. If your SourceNext password matches your email password, your shopping password, or your banking password, the breach just became a breach of those accounts too. The credential stuffing explainer walks through how that works. The fix is unglamorous: unique passwords everywhere, starting with the accounts that hold your money and your inbox.
The one field you could have made expendable
The email address you gave SourceNext is the one field in this leak you could have made expendable. An email alias dedicated to SourceNext, forwarding to your real inbox, changes what the attacker actually holds.
Every message on that alias is either from SourceNext or from the attacker, and there is no third option. A phishing email quoting the real breach notice, arriving on an address no one but SourceNext ever had, has identified itself: it came from the leaked file. The leak-tracing mechanism works exactly this way. Kill the alias and the whole impersonation channel dies while your real inbox stays clean. The set-up guide takes about two minutes.
That is the limit of the idea, stated plainly. An alias protects your email address. It does not protect your name, your address, your phone number or your job title, and this breach leaked all of those. What it does is narrower and still worth having: it stops the attacker from reaching your real inbox with messages that look like they come from a company you trust, and it tells you exactly which breach a message came from. In a leak where the phishing wave will wear SourceNext's own wording, knowing the source of a message is half the battle.
What to do now
- Reset your SourceNext password when prompted at login. Do it through SourceNext's own site, typed by you into the browser, not through a link in an email.
- Change the same password everywhere else you reused it. If the SourceNext combination matches any other account, that account is now exposed too. Start with your email, your bank, and any account that can reset other passwords.
- Turn on two-factor authentication on your email account. Leaked names, addresses, dates of birth and phone numbers are the raw material of account-recovery flows. A second factor is the part the attacker cannot talk their way past.
- Do not click links in unexpected messages about this breach. SourceNext warns that phishing mail, SMS, phone calls and postal mail impersonating SourceNext or related parties may follow. Its own guidance emails go to registered addresses in sequence, which means a forged one can arrive first. If a message claims to be from SourceNext, go to SourceNext's own site yourself. The company also runs a dedicated helpline on 0120-035-116, 10:00 to 18:00 including weekends, and lists further questions in its breach FAQ.
- Expect impersonation that knows your details. The leaked fields include your name, your address, your phone number, your employer and your job title. A caller who reads those back to you is proving they have the file, not that they are SourceNext. Real support never needs you to confirm a password over the phone.
- Check Have I Been Pwned once the incident is listed, and walk the breach-response order of operations.
What comes next
One thing to watch is whether SourceNext upgrades "may have leaked" to confirmed exfiltration, and whether it names the number actually taken. That turns a worst-case file size into a real victim count. The other is whether the dataset surfaces publicly or the postmortem explains how the API was abused, and until either lands, reset the password, change the reused ones, and treat every SourceNext message that arrives by link with suspicion. The company that sells trust owes its users an explanation for those four days, and its users should not wait for the explanation to protect themselves.
Top comments (0)