Sourcenext says misuse of a member API may have exposed 22.5 million records

Japanese software seller Sourcenext says an outside party misused the API behind its member-information system, and that 22,519,960 records of customer information may have leaked. The company set out the incident in a notice dated October 15.

What the company says happened

According to the notice, the unauthorized access began at about 10:00 on October 9, Japan time, when a third party used the member-information API to retrieve customer data. Sourcenext says it confirmed the access at about 09:00 on October 13 and completed containment at 13:36 the same day. It says no further unauthorized access has been confirmed since.

The notice says the report to Japan's Personal Information Protection Commission was completed on October 15, and that a report to the local police station was planned for October 16.

What data may be affected

The company lists email addresses, passwords, names, names in kana, addresses, genders, phone and fax numbers, and dates of birth among the data that may have been exposed. It also lists company names, job titles, departments, and system identifiers such as subscribed services, registration dates and login dates. The notice says not every customer had every item exposed.

ASCII.jp's report, published October 16, repeats the 22,519,960 figure and quotes the company as saying credit card information was not stored on the affected system. The notice uses the Japanese unit 件, meaning records, and does not say how many individual people are affected.

The company's response

Sourcenext says it blocked unauthorized external communications, began continuous monitoring and ran an emergency inspection of all its systems. It says all passwords have been invalidated and customers must reset them, and that affected customers will be notified by email. The notice adds that the password-reset site is congested.

The company asks customers to be alert to phishing by email, SMS, phone or mail that impersonates it, and to change passwords on other services where they used the same email and password combination. It says it plans a comprehensive review of its security, monitoring and information management systems and will publish newly confirmed facts on its website.

What is unresolved

The notice does not describe a specific vulnerability, and it does not explain how the API allowed such a volume of records to be retrieved over the period. The company says it is working with an external specialist firm to determine the root cause and the full scope. It has not said how passwords were stored. Until that investigation reports, the 22,519,960 figure is the company's count of records that may have leaked, not a confirmed count of records taken or of people affected.