The Japanese company, which sells security software, disclosed a breach of its customer registration system. The incident is an uncomfortable reminder for anyone who uses the same password everywhere.
The worst kind of notification turns a forgotten account into an urgent chore. Japanese software company Sourcenext announced on October 15, 2026, that third parties had obtained customer information through unauthorized access. The potentially affected data covers 22,519,960 records, with passwords among the information involved. That figure refers to records at risk, not a confirmed count of distinct individuals.
Customers can consult the official notice and the FAQ. The company says credit card information is not included because it was not stored in the affected system.
What happened at Sourcenext?
According to the company’s timeline, unauthorized access began at around 10 a.m. on October 9. It was detected at approximately 9 a.m. on October 13 and contained by 1:36 p.m. that day. These are the times given in the Japanese announcement.
The company attributes the extraction to misuse of an API for retrieving member information. Potentially exposed fields include contact, identity and registration details, such as email addresses, passwords, names, home addresses, phone numbers, dates of birth and employment information. This does not mean that every field was leaked for every registered customer: the information depended on what each person had provided.
An ITmedia NEWS report published on October 16 corroborates that timeline and describes the reaction in Japan. The company began resetting passwords and asking users to set new ones when logging in, while notifying customers by email. Those without a registered email address were due to be contacted by post.
“Doesn’t it sell antivirus software?”
Yes. Sourcenext sells the ZERO security range alongside other software and services. That raises an understandable question: how did a company that sells security end up in this situation?
The contrast makes an immediate impression when a company in this sector suffers a breach. But the technical distinction matters: the disclosed incident affected the customer information system. The sources reviewed provide no evidence that the attack exploited the antivirus software the company sells. Conflating the store and its customer records with the products it sells creates a separate problem: misinformation.
These documents also provide no basis for claiming that passwords were stored in plaintext. The verified sources do not establish the storage format or the full details of the vulnerability.
A reused password can become a master key
For PC gamers, the relevance does not require a direct connection to a game. The issue is the habit of using the same credentials across stores, forums and services. OWASP describes credential stuffing as testing username-and-password pairs obtained from another site’s breach. If a combination works in several places, a problem with one account can spread to others.
This is different from guessing a password from scratch: the attacker starts with an existing combination. That explains the general risk; it does not confirm that gaming accounts were compromised in this incident.
Multifactor authentication adds a meaningful barrier against password-based attacks, as OWASP’s MFA guidance explains. It is worth enabling wherever available. The additional layer does not erase exposed data or eliminate every scam, but it reduces reliance on a single secret.
What customers should do now
Sourcenext advises customers to reset their account password and change passwords on other services where the same combination was reused. The company also warns about fraudulent contact by email, text message, telephone or post. To check the instructions, visit the official address rather than automatically trusting a link sent to you.
The case offers a rule of thumb that is considerably less fun than choosing your next upgrade: every account needs its own password. Reusing credentials turns separate accounts into doors that accept the same key. Your least important account can end up creating extra work to protect your most valuable one.
Sources checked on October 18, 2026. The extent of each customer’s exposure and the technical details remain subject to further clarification from the investigation.
