{
  "type": "NewsArticle",
  "url": "https://sonomos.ai/newsroom/sourcenext-member-api-misuse-22-million-records/",
  "slug": "sourcenext-member-api-misuse-22-million-records",
  "title": "Sourcenext says misuse of a member API may have exposed 22.5 million records",
  "summary": "Japanese software seller Sourcenext says a third party misused its member-information API for about four days, and that 22,519,960 records may have leaked, including emails and passwords.",
  "section": "Cybersecurity",
  "category": "cybersecurity",
  "format": "news",
  "tags": [
    "data breach",
    "API security",
    "Japan",
    "credentials"
  ],
  "published_at": "2026-10-19T13:20:00.000Z",
  "updated_at": "2026-10-19T13:20:00.000Z",
  "word_count": 436,
  "publisher": {
    "name": "Sonomos Newsroom",
    "url": "https://sonomos.ai/newsroom/",
    "standards": "https://sonomos.ai/newsroom/standards/",
    "organization": {
      "name": "Sonomos",
      "url": "https://sonomos.ai/"
    }
  },
  "follows_up": null,
  "followed_by": [],
  "sources": [
    {
      "number": 1,
      "title": "Notice about unauthorized access to the member information system",
      "publisher": "Sourcenext Corporation",
      "url": "https://www.sourcenext.com/support/i/2026/1015_info/",
      "published": "2026-10-15",
      "accessed": "2026-10-19"
    },
    {
      "number": 2,
      "title": "Sourcenext warns of potential data breach affecting 22.51 million records",
      "publisher": "ASCII.jp",
      "url": "https://ascii.jp/en/elem/000/004/443/4443122/",
      "published": "2026-10-16",
      "accessed": "2026-10-19"
    }
  ],
  "verification": {
    "method": "automated-source-check",
    "checked_at": "2026-10-19T13:18:00.000Z",
    "description": "https://sonomos.ai/newsroom/standards/",
    "claims": [
      {
        "claim": "22,519,960 records of customer information may have leaked.",
        "source": 1,
        "source_url": "https://www.sourcenext.com/support/i/2026/1015_info/"
      },
      {
        "claim": "A third party began misusing the member-information API on October 9 and the company confirmed it on October 13.",
        "source": 1,
        "source_url": "https://www.sourcenext.com/support/i/2026/1015_info/"
      },
      {
        "claim": "Credit card information was not stored in the affected system.",
        "source": 2,
        "source_url": "https://ascii.jp/en/elem/000/004/443/4443122/"
      },
      {
        "claim": "The company reported the incident to Japan's Personal Information Protection Commission on October 15.",
        "source": 1,
        "source_url": "https://www.sourcenext.com/support/i/2026/1015_info/"
      }
    ]
  },
  "corrections": [],
  "body_markdown": "Japanese software seller Sourcenext says an outside party misused the API behind its member-information system, and that 22,519,960 records of customer information may have leaked. The company set out the incident in [a notice dated October 15](https://www.sourcenext.com/support/i/2026/1015_info/).\n\n## What the company says happened\n\nAccording to the notice, the unauthorized access began at about 10:00 on October 9, Japan time, when a third party used the member-information API to retrieve customer data. Sourcenext says it confirmed the access at about 09:00 on October 13 and completed containment at 13:36 the same day. It says no further unauthorized access has been confirmed since.\n\nThe notice says the report to Japan's Personal Information Protection Commission was completed on October 15, and that a report to the local police station was planned for October 16.\n\n## What data may be affected\n\nThe company lists email addresses, passwords, names, names in kana, addresses, genders, phone and fax numbers, and dates of birth among the data that may have been exposed. It also lists company names, job titles, departments, and system identifiers such as subscribed services, registration dates and login dates. The notice says not every customer had every item exposed.\n\n[ASCII.jp's report](https://ascii.jp/en/elem/000/004/443/4443122/), published October 16, repeats the 22,519,960 figure and quotes the company as saying credit card information was not stored on the affected system. The notice uses the Japanese unit 件, meaning records, and does not say how many individual people are affected.\n\n## The company's response\n\nSourcenext says it blocked unauthorized external communications, began continuous monitoring and ran an emergency inspection of all its systems. It says all passwords have been invalidated and customers must reset them, and that affected customers will be notified by email. The notice adds that the password-reset site is congested.\n\nThe company asks customers to be alert to phishing by email, SMS, phone or mail that impersonates it, and to change passwords on other services where they used the same email and password combination. It says it plans a comprehensive review of its security, monitoring and information management systems and will publish newly confirmed facts on its website.\n\n## What is unresolved\n\nThe notice does not describe a specific vulnerability, and it does not explain how the API allowed such a volume of records to be retrieved over the period. The company says it is working with an external specialist firm to determine the root cause and the full scope. It has not said how passwords were stored. Until that investigation reports, the 22,519,960 figure is the company's count of records that may have leaked, not a confirmed count of records taken or of people affected.",
  "links": {
    "html": "https://sonomos.ai/newsroom/sourcenext-member-api-misuse-22-million-records/",
    "markdown": "https://sonomos.ai/newsroom/sourcenext-member-api-misuse-22-million-records/index.md",
    "json": "https://sonomos.ai/newsroom/sourcenext-member-api-misuse-22-million-records/index.json",
    "image": "https://sonomos.ai/og/newsroom/sourcenext-member-api-misuse-22-million-records.png"
  }
}