Sourcenext Says API Abuse Exposed Data From Up to 22.5 Million Customer Records
Summary
Sourcenext says attackers used an internal API from October 9 to 13 to extract customer records, potentially affecting up to 22,519,960 accounts. Exposed fields included passwords and contact details; the company reset customer passwords.
Key points
- Attackers reportedly used an internal member-information API to query and extract customer profiles over four days, beginning October 9.
- Sourcenext estimates up to 22,519,960 customer records may have been compromised.
- Potentially exposed information included email addresses, passwords, names, addresses, birth dates, phone numbers, and other profile details.
- Audit logs showed unauthorized traffic detected on October 13; staff took more than four hours to stop the connections.
- Sourcenext reset customer passwords, reported the incident to Japan’s Personal Information Protection Commission, and hired external forensic investigators.
- The advisory did not establish whether passwords were salted and hashed; plaintext storage is an analyst suspicion, not a confirmed finding.
Article Details
- Victim Organization
- Sourcenext
- Incident Type
- Unauthorized automated queries against an internal member information API, resulting in a customer data breach
- Incident Date
- 2026-10-09
- Data Types Exposed
- Email addresses
- Account passwords
- Legal names
- Kana phonetic names
- Postal addresses
- Birth dates
- Corporate affiliations
- Executive job titles
- Telephone numbers
- System registration dates
- Affected Records
- Up to 22,519,960 customer records, according to the company's estimate
- Operational Impact
- Unauthorized API queries began on October 9 at 10:00 AM and continued for four consecutive days. Administrators detected unauthorized network traffic on October 13; technical staff took more than four hours to sever the connections and stop the activity. Sourcenext reset all customer passwords and engaged external forensic investigators.
- Claim Status
- confirmed