Sourcenext: up to 22.52 million member records leaked via unauthorized API access
sourcenext-breach-2026 · Disclosed 2026-10-15
Sourcenext's member information retrieval API was abused by a third party, potentially leaking up to 22,519,960 member records. Passwords were encrypted but leaked in plaintext due to intrusion into a system with access to decryption keys. The attack began on October 9 and was detected and contained on the 13th.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
Unauthorized access began around 10:00 on October 9, with the attacker abusing the member information retrieval API. The breach was confirmed around 9:00 on the 13th and containment was completed by 13:36.
[s1]10月9日（金）10時頃から不正アクセス - Reported fact
The number of potentially affected records is 22,519,960. Affected information includes email addresses, passwords, names, addresses, phone numbers, and birth dates. Credit card information was not stored in the target system and is not included in the leak.
[s1]対象件数：22,519,960件 - Reported fact
Passwords were stored encrypted, but leaked in decrypted form due to unauthorized access to a system (API) with access to decryption keys. The system's development period was old, and migration to modern hashing methods had not been completed.
[s3]暗号化されたパスワードを復号するための鍵にアクセス可能なシステム
Timeline
Unauthorized access began around 10:00. [s1]
Confirmed unauthorized access around 9:00. Blocked unauthorized external communications and completed containment by 13:36. [s1]
Completed report to Personal Information Protection Commission and made public announcement. [s1]
Filed damage report with police. Requested third-party investigation from external independent security specialists. [s2]
Reported response
- Reported fact
Took immediate emergency measures after detecting unauthorized access and completed containment by 13:36. Reset passwords included in the leak scope and require password reset at login.
[s1]10月13日（火）13時36分までに封じ込め対応を完了 - Reported fact
Proceeding with detailed investigation in cooperation with external specialist agencies while conducting emergency inspection of all systems.
[s1]外部の専門調査機関と連携して詳細な調査
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Continued use of outdated encryption methods and inadequate protection of APIs with access to decryption keys. Related rules inspect password hashing, API authentication, and access controls.
Editorial assessment; not a determination of liability. [s3]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
Specific API intrusion path, CVEs used, and exact count of leaked email addresses remain unresolved. The system's development period was also not disclosed.
Sources
[s1] ソースネクスト · Primary source
当社サイトへの不正アクセスによるお客様情報流出のお詫びとお知らせ ↗Published 2026-10-15 · Reviewed 2026-11-02
[s2] ソースネクスト · Primary source
情報漏洩に関するよくあるご質問 ↗Published 2026-10-15 · Reviewed 2026-11-02
[s3] ITmedia NEWS · Secondary
ソースネクスト、パスワードなぜ平文で流出 「暗号化していたが、鍵にアクセスできるシステムに侵入された」 ↗Published 2026-10-19 · Reviewed 2026-11-02