Key takeaways
- SourceNext (ソースネクスト), a Japanese software maker and retailer best known abroad for the Pocketalk translator, says attackers abused a member information API from October 9 to 13, 2026 and took data on 22,519,960 member records.
- The data includes email addresses and passwords, names, addresses, phone numbers, birth dates, and for some members their employer, job title and department. Card data was not in the system.
- According to Nikkei, the passwords were encrypted, not hashed, and the attackers compromised the program that decrypts them. SourceNext itself warns that the stolen email and password combinations may be used to log in to other services.
- It is the second-largest breach disclosed in Japan this year, after Gyazo.
- SourceNext found the access on October 13 and announced it on October 15. It has reset passwords, reported to the Personal Information Protection Commission, and planned to report to the police on October 16.
What happened#
| Date (2026) | Event |
|---|---|
| Oct 9 (Fri), ~10:00 | A third party starts abusing a member information retrieval API (会員情報取得API) to obtain customer data |
| Oct 13 (Tue), ~09:00 | SourceNext confirms unauthorized access to the system that manages member information, and cuts off the malicious traffic |
| Oct 13, 13:36 | Access contained. SourceNext says it fixed the vulnerability and reset the affected passwords |
| Oct 15 (Thu) | Public notice and FAQ. Report to the Personal Information Protection Commission |
| Oct 16 (Fri) | Planned report to the police |
The access ran for about four days before it was found. SourceNext says it is checking all its systems for other vulnerabilities, and that no unauthorized access has been seen since containment.
Asked why it did not announce on the day, SourceNext says it first focused on stopping the damage and identifying the scope, and wanted to avoid "confusion caused by uncertain information", so it published after checking the facts and reporting to the authorities.
What was taken#
| Data | Status |
|---|---|
| Email address and password | Taken |
| Name and its reading, sex, date of birth | Taken |
| Address, phone number, fax number | Taken |
| Company name, job title, department | Taken, where registered |
| System identifiers: subscribed services, registration date, last login | Taken |
| Credit card data | Not stored in the affected system |
Not every member's record contains every item. All members registered by 13:36 on October 13 are in scope. SourceNext is emailing them, and sending letters to those without an email address. It says it never collected identity documents, so the data alone should not be enough to open phone contracts or take out loans in a victim's name.
The passwords#
SourceNext's own notice does not say how passwords were stored. But it treats them as usable: it warns that the stolen combinations of email address and password may be used to try to log in to other services, and it has reset every affected password.
Nikkei reported on October 15 that the passwords had been stored encrypted, and that the attackers had hacked the program that removes the encryption. That explanation is not in SourceNext's published notice or FAQ, and the company has not said what the program was or how it was reached.
If Nikkei's account is right, it matters in two ways:
- Encryption is not hashing. A properly stored password is put through a one-way hash function, with a unique salt and a deliberately slow algorithm such as bcrypt, scrypt or Argon2. The service can check a password but cannot recover it. Encrypted passwords can be turned back into the originals by anyone who gets the key, or, as here, the program that holds it.
- The API and the decryption may be linked. The attackers took the data through a member information API. If that API, or the system behind it, could return decrypted passwords, the flaw is not only in one endpoint but in the design: no API should ever be able to hand out a member's password. This is our reading of the two statements together; SourceNext has not described how the decryption program was reached.
What we don't know yet#
SourceNext has not said:
- What the vulnerability was, and how the attackers found the member information API
- How passwords were stored, in its own words, and what the decryption program was
- How many people the 22.5 million records represent, and which services they belong to, including whether Pocketalk users are among them
- Why four days of API abuse went unnoticed
Our analysis#
An API that returned too much#
The method matches the pattern Japan's responders have been warning about. JPCERT/CC's October warning described attackers abusing internal APIs, and its investigation of attackers' servers, published the same day as SourceNext's notice, found tools for analysing apps and testing APIs. On the same day, Burger King Japan disclosed that 11.18 million app members' data had been taken. SourceNext has not said whether an app was involved, and nothing links the cases directly. What they share is the result: an interface built to serve one member's data returned millions.
An API that can return 22 million records in four days without raising an alarm also lacked effective rate limits and monitoring. Those are basic controls for any endpoint that returns personal data.
A security vendor, and a second breach#
SourceNext also sells security software, which will make this breach harder for customers to accept. It is also not the company's first. In February 2023, it disclosed that its online store had been compromised and that data on about 121,000 customers, including 112,000 card numbers, may have leaked. Then, too, it took more than a month to announce, and it explained the delay in almost the same words: publishing uncertain information would only cause confusion.
This time it announced two days after finding the access, which is faster. But in our view, "avoiding confusion" is the wrong frame when passwords are involved. Every hour that members do not know their email and password combination has been taken is an hour in which it can be tried on their other accounts.
What this means for readers#
- If you store passwords, hash them with a unique salt and a slow algorithm (bcrypt, scrypt or Argon2). Never store them in a form your own systems can decrypt.
- If you run APIs that return member data, make sure each call can only return the caller's own record, rate-limit them, and alert on bulk retrieval. Assume attackers will find undocumented and internal endpoints.
- If you have a SourceNext account, change the password on every other service where you used the same one, and enable two-factor authentication where you can. Expect phishing that uses your name, employer and job title.
- If you manage corporate security, note that work email addresses, employers and job titles were taken. That is useful for targeted phishing against companies whose staff registered with SourceNext.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| ソースネクスト | Sōsu Nekusuto | SourceNext Corporation |
| 会員情報取得API | kaiin jōhō shutoku API | Member information retrieval API |
| 封じ込め | fūjikome | Containment |
| 暗号化して保存 | angōka shite hozon | Stored encrypted |
| 暗号化を解除するプログラム | angōka o kaijo suru puroguramu | Program that removes the encryption (decrypts) |
| パスワードのリセット | pasuwādo no risetto | Password reset |
| 被害申告 | higai shinkoku | Report of damage (to the police) |
We will update this article when SourceNext publishes more about the cause.