Do Son 
Prominent Japanese software distributor Sourcenext recently issued an urgent security notice to its customers. Specifically, unauthorized actors abused an internal member information query API to harvest vast amounts of customer data. Consequently, the company estimated that the incident compromised up to 22,519,960 customer records. The exposed database contained registered email addresses, account passwords, legal names, physical addresses, and telephone numbers. Although the exact compromised data fields vary across individual profiles, Sourcenext proactively reset all customer passwords.
Four-Day API Exploitation Window
According to internal audit logs, administrators first detected unauthorized network traffic on the morning of October 13. However, technical staff took more than four hours to sever rogue connections and halt the attack.
Subsequent digital forensics revealed that the intrusion began much earlier. In fact, adversaries initiated automated API queries on October 9 at 10:00 AM. Over four consecutive days, attackers systematically matched and extracted member profiles in massive batches. Therefore, Sourcenext promptly reported the security failure to the Personal Information Protection Commission of Japan. In addition, management engaged specialized external forensic investigators to evaluate the breach architecture.
Compromised Customer Records and Credential Risks
In an official security advisory to customers, Sourcenext detailed the extensive categories of potentially exposed data. These records include customer email addresses, account passwords, kana phonetic names, postal addresses, and birth dates. Furthermore, corporate affiliations, executive job titles, telephone numbers, and system registration dates were compromised.
Concerns Over Plaintext Password Storage
Notably, the advisory explicitly classified account passwords among the compromised fields. The security notice did not confirm whether the database utilized modern cryptographic salting and hashing. Consequently, security analysts suspect the platform stored credentials in plaintext. While hashed passwords present limited immediate utility to intruders, plaintext exposure creates catastrophic credential-stuffing risks across unrelated web platforms.
Broad Consumer Exposure and Account Mitigation
Many international customers established Sourcenext accounts to purchase discounted software licenses, such as multi-year subscriptions to 1Password. Although privacy-conscious buyers frequently registered with randomized passwords, their genuine names, addresses, and email contacts remain vulnerable.
Moving forward, affected account owners face heightened risks of targeted phishing campaigns and spam communications. Therefore, cybersecurity specialists advise all past Sourcenext customers to review their active online credentials immediately. Users must change any duplicate passwords across secondary online accounts without delay. Ultimately, deploying dedicated password managers to generate unique credentials remains the most effective defense against systemic corporate data breaches.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
