SourceNext says a member-data API was abused, exposing up to 22,519,960 customer records including passwords

SourceNext said on 15 October that third-party unauthorized access to the member data it manages had leaked personal information of registered customers ^[1]. It said it confirmed the access on 13 October and finished containment by 13:36 that day, and that a member-information API had been abused from 9 October; up to 22,519,960 records may have been taken, including email addresses, passwords, names, addresses, phone numbers and dates of birth, while credit-card data was not in the affected system ^[1]. The company is requiring a password reset at login, asks anyone who reused the same email and password on other services to change those passwords too, and warns customers not to open unsolicited email or SMS links or attachments, or enter personal data or passwords on suspicious sites ^[1].

Industries mainly affected: Technology

1. Follow the login prompt and reset your SourceNext password promptly ^[1].
2. If you reused the same email and password on other services, change those passwords as well .