The API Is the New Front Door: How SourceNext Lost 22.5 Million Records

There is a particular irony when a company that sells antivirus software gets hacked. On October 15, SourceNext, the Japanese software maker behind the PocketTalk AI translator and its own line of security products, disclosed that unauthorized access to its member information management system may have exposed up to 22,519,960 customer records. It is the second-largest corporate data breach in Japanese history, behind only the 35.04 million records leaked by Benesse Corporation in 2014.

But the record numbers are not the real story. No ransomware gang encrypted servers. No zero-day vulnerability was exploited. According to the company's disclosure, the attackers simply used an API, one of the same programming interfaces companies build to let apps and services retrieve data conveniently, and asked it, repeatedly, for member information. For roughly four days, the company's own systems handed the data over.

What happened

SourceNext says the unauthorized access began around 10:00 a.m. on October 9, with the intruders exploiting an API used to retrieve member information. An employee noticed the anomaly around 9:00 a.m. on October 13, and emergency measures to block unauthorized external communications were completed by 1:36 p.m. that day. Since then, the company says, no further unauthorized access has been confirmed.

The list of potentially exposed fields reads like a complete identity kit: email addresses, passwords, names and phonetic readings, addresses, gender, phone and fax numbers, dates of birth, company names, job titles, department names, subscribed services, registration dates, and login dates. SourceNext cautions that not every field was compromised for every person, and that the specific items vary by registration status. One meaningful bit of good news: credit card information was never stored on the affected system, so payment data is outside the scope of the breach.

The password detail is the one worth watching. Japan's Nikkei reported that the passwords were encrypted rather than hashed, and that the program used to decrypt them was itself compromised. That distinction matters enormously. A hashed password is effectively a one-way fingerprint: even if stolen, it cannot be reversed. An encrypted password is reversible by design, and if the attacker also holds the decryption tool, the protection collapses entirely. SourceNext has not disputed the characterization while its forensic investigation continues.

The company is now requiring password resets on login for every member registered as of 1:36 p.m. on October 13, sending notifications by email and by postal mail where no email address is on file. It warned that affected users may face phishing attempts by email, SMS, phone calls, or even physical mail built from the leaked data, and opened a dedicated hotline. A report to Japan's Personal Information Protection Commission was completed on October 15, and the company said it would file a criminal complaint with police the following day. The market reacted fast: the disclosure landed after the Tokyo close, and in after-hours trading the stock fell to 96.6 yen, 8.87 percent below the closing price of 106 yen.

The attackers did not break in. They walked through a door the company built for convenience and never guarded.

An extraordinary state of affairs

SourceNext is not an isolated incident. It is the loudest note in what credit research firm Tokyo Shoko Research calls an extraordinary state of affairs with large-scale data breaches occurring in rapid succession. On the very same day as the SourceNext disclosure, BK Japan, the operator of Burger King in Japan, disclosed that approximately 11.18 million official app member records had been compromised. Earlier this year, telecom giant KDDI reported unauthorized access to email systems affecting about 12.23 million records, and Monogatari Corporation, the Yakiniku King restaurant chain, disclosed a member information leak of about 10.78 million.

The statistics are stark. Breaches exceeding 10 million records at listed companies and their subsidiaries occurred only three times in the 14 years from 2012 through 2025, when tracking began. In 2026, three incidents at that scale had already happened by October 5. Breaches exceeding one million records reached 10 incidents by that same date, compared with six in all of 2025. The list of 2026's million-record-plus breaches, maintained by independent trackers, now runs to 29 entries.

October alone has been brutal. Japan Cyber Watch's weekly review notes that SourceNext's four-day API abuse sat alongside Burger King Japan's app compromise of 11.18 million records between October 2 and 7, Yamato Transport's confirmation that 5.26 million Kuroneko pay-later records were taken including what customers bought, and the newspaper Nikkei's fifth incident in under a year. Japan's consumer-facing economy is leaking personal data at a pace it has never seen before.

Why APIs keep getting hit

There is a reason the attack method in the SourceNext case deserves more attention than the headline number. Modern companies expose internal data through APIs for everything: mobile apps, partner integrations, analytics pipelines, customer portals. Each one is a front door. Unlike a phishing campaign or a malware intrusion, API abuse needs no exploit at all. The attacker just asks, politely and at machine speed, and the system complies. The same technique recently showed up in a U.S. utility breach, where an attacker cycled through millions of customer IDs on a public API with no effective rate limiting.

Security experts quoted in the Japanese coverage are renewing calls for the unglamorous basics: multi-layered defense, enhanced system monitoring that can spot an API being milked for days, multi-factor authentication, and stricter management of API access itself, including rate limiting and anomaly detection on who is asking for what. None of this is new technology. It is the operational discipline of treating every API like a door that needs a lock, a log, and someone watching the log.

Details of the attack method and the intrusion route remain unclear, and SourceNext says it is working with external forensic investigators while conducting emergency inspections of all its systems. The company promises a fundamental review of its security measures, monitoring systems, and information management practices. For the 22.5 million people in its member database, the practical advice is the familiar drill: reset the password, change it anywhere else it was reused, and treat unexpected messages that know your name, address, and birthday with deep suspicion. The front door is closed now. The question is what walked out through it while it was open.