SOURCENEXT says up to 22,519,960 records may have leaked through member API

SOURCENEXT, a developer of PC software and security products, announced on October 15, 2026 that unauthorized access to its member information management system may have exposed up to 22,519,960 customer records. Attackers exploited an API used to retrieve member information starting at about 10 AM on October 9; an employee detected the anomaly on October 13 and the access was blocked that afternoon. The figure is the company's stated maximum of potentially exposed records, not a confirmed count of records taken. The data fields involved vary by user and can include email addresses, passwords, names, addresses, phone numbers, dates of birth, and workplace details. Credit card information was not stored on the system.

The company said it has required password resets for all members registered as of October 13 and filed its report with the Personal Information Protection Commission on October 15. Because the count is potential only, SecurTek lists this breach without adding the figure to the records exposed total, and will update the item when a confirmed count is published.

Sources: BigGo Finance; TradingView (Reuters, reporting Kyodo)