Sourcenext member data API abused, putting up to 22.52 million customer records with passwords and addresses at risk

According to Impress Watch, Japanese software maker Sourcenext announced on October 15 that a third party gained unauthorized access and that 22,519,960 customer records may have leaked ^[1]. The attacker abused a member data retrieval API from the morning of October 9 to obtain registered data, possibly including emails, passwords, names, addresses, phones and birth dates; the company contained the access on the 13th and card data was not stored in the system ^[1]. Sourcenext members must reset their password at login and should beware of phishing emails, texts, calls and mail impersonating Sourcenext or related parties ^[1].

Industries mainly affected: Technology

1. Reset your Sourcenext password when prompted at login ^[1].
2. Change the same password on other services ^[1].
3. Beware of phishing emails, texts, calls and mail impersonating Sourcenext or related parties .