Sourcenext data breach

What happened

Software seller Sourcenext, known in Japan for New Year's card software, said on October 15, 2026 that outsiders abused an API for retrieving member information and took customer data from its member management system. The access began around 10 a.m. on October 9, was found on October 13 and was contained that afternoon. Up to 22,519,960 customer records may have leaked, with fields varying by account: email addresses, passwords, names, addresses, gender, phone and fax numbers, dates of birth, and company names, job titles and departments. Credit card information was not stored in the affected system. Sourcenext is requiring a password reset at login and reported the incident to Japan's Personal Information Protection Commission.

What should I do?

1. Reset your Sourcenext password when prompted at login, going to sourcenext.com directly rather than through an emailed link.
2. Change the password on any other site where you used the same or a similar one, starting with email, shopping and banking accounts.
3. Expect phishing emails, texts, calls or letters posing as Sourcenext or its partners, and don't enter passwords or card details from links in them.
4. If your work email or employer was on your account, warn your company's IT team about targeted phishing.

More data breaches in Japan →

Check the other services you use →