Per Sourcenext’s notice, the fields that may have leaked are email address, password, name (kanji and kana), address, gender, phone and fax numbers, date of birth, company name, job title and department, and system data such as subscribed services, registration date and last login. Not every record has every field. Credit card data was not stored in the affected system. How the passwords were stored: Undisclosed.
What it has done. Sourcenext cut off the attacker’s traffic, says it’s seen no access since containment, reported to Japan’s Personal Information Protection Commission on Oct 15 and planned to file a police report on Oct 16. In an Oct 16 update it said every customer password has already been changed and old passwords no longer work; the reset site is struggling under load. Root cause and how the attacker got API access: Undisclosed.
Scale. ITmedia, citing Tokyo Shoko Research, says it’s the second-largest personal-data leak disclosed by a Japanese listed company, behind Benesse’s roughly 35.04 million records in July 2014. Sourcenext shares fell 4.7% to ¥101 on Friday, a year-to-date low, per Investing.com.
Why a security team should care. Two things. First, the company/title/department fields turn this from a consumer list into a B2B targeting list: real employees, their employer and role, a working email and possibly a reused password. Expect credential stuffing against corporate SSO and Microsoft 365 in Japan, plus vendor-impersonation phishing that name-drops Sourcenext. Second, this came out through an API the company built to serve member data. Four days of bulk reads didn’t trip anything until Oct 13.
What we’d do today. If your users are in Japan, pull the domains your staff register with and push resets for anyone who might reuse a password, then watch for spray and stuffing from new ASNs. If you run a member API, put volume baselines and per-caller rate limits on record-retrieval endpoints, enforce object-level authorization on every call, and alert when one client walks sequential IDs.