A security-software seller, read out through its own API. SourceNext has sold the ZERO antivirus range since 2006. From about 10:00 on 9 October, someone used its member-information API to pull records out of its member system. An employee noticed at about 09:00 on 13 October, and the access was shut off by 13:36. By then up to 22,519,960 records, with email addresses and passwords among them, may have gone. That is more than the “over 20 million” members SourceNext counts across its history, and the third-largest disclosure in Japan in a year.
What SourceNext has disclosed
SourceNext sells software and devices to households and organizations. Its security line is the ZERO range: Virus Security ZERO since 2006 and Super Security ZERO, built on Bitdefender's engine, since 2011. It also sells the Fudegurume New Year card software, distributes the Meeting Owl conference camera in Japan, and sells the Pocketalk translator through its subsidiary Pocketalk Inc. It published its notice and a FAQ on 15 October 2026. SourceNext notice (Japanese) · FAQ (Japanese)
- 9 October, from about 10:00. A third party began misusing the API that retrieves member information, and took information registered with SourceNext.
- 13 October, about 09:00. SourceNext confirmed unauthorized access to the system that manages member information. Kyodo reports that an employee found it. The access was contained by 13:36 the same day, and SourceNext says it has seen none since.
- 15 October. SourceNext reported to the Personal Information Protection Commission and published its notice. It is emailing members in turn, is requiring a password reset at the next sign-in, and says it will report the damage to the police. Nikkei (Japanese) · Impress Watch (Japanese)
| What | Detail |
|---|---|
| Records in scope | 22,519,960: members registered up to 13:36 on 13 October 2026 |
| Data that may have leaked | Email address, password, name and its reading, address, gender, phone and fax numbers, date of birth, company name, department, job title, and system data such as subscribed services, registration date and last sign-in |
| Not included | Card details, which SourceNext says were not stored in this system |
| Caveat | Not every member had every field |
Reports round the count differently: Nikkei says 22.52 million, Kyodo and Impress Watch “up to 22.51 million”. The notice gives 22,519,960. Kyodo via Yahoo! News (Japanese) · ITmedia PC USER (Japanese)
Figure 1. Four days of API access, and the rate it implies. Original graphic for this article.
Four numbers that matter
22,519,960 against “over 20 million”. Nikkei describes SourceNext's membership as over 20 million, counted cumulatively. The records in scope exceed that, and the FAQ defines them as everyone registered up to the moment the access was shut off. This is not a slice of the member base; it is the member base, including people who registered once for a product years ago. A record is not a person, so the number of people is lower, but nobody registered with SourceNext should assume they are outside it.
About 66 records a second. SourceNext has not said how the records were pulled or whether it ran continuously. If they were spread evenly between 10:00 on 9 October and the discovery at about 09:00 on 13 October, that is about 237,000 records an hour, around the clock, for four days. This is our arithmetic, not SourceNext's. It still shows the scale of the gap: traffic on that scale is exactly what per-caller volume alerts on an API are for.
“Password”, with no qualifier. The notice and FAQ list passwords among the leaked fields without saying whether they were hashed. Skyticket's notice of 9 October, by contrast, said its 4.13 million passwords were hashed (our analysis). Until SourceNext says otherwise, treat every SourceNext password as known to the attacker. That is also how SourceNext is acting: it is forcing a reset at the next sign-in, and asking members to change the same password wherever else they used it.
Third in a year. In the 12-month list of our 60-day review, only EPARK Relax & Esthe (about 33 million records) and Gyazo (about 23.62 million user records) are larger. SourceNext's notice came a week after that list closed, as did Skyticket's.
Figure 2. SourceNext against the year's largest disclosures. Original graphic for this article.
Who buys from SourceNext
SourceNext is not a security vendor in the enterprise sense. It sells boxed and downloadable software and devices through electronics stores, its online shop and corporate sales. But antivirus is one of its best-known lines, and that makes this breach awkward: a company that sells protection to consumers has not said how it stored their passwords.
Anyone who registers a product, buys from the online shop or signs up for a service has a member record. The notice lists company name, department and job title among the leaked fields, so business registrations are in the database too.
| Product line | What it is | Who uses it |
|---|---|---|
| ZERO security software | Virus Security ZERO (2006) and Super Security ZERO (2011, Bitdefender engine), sold without an annual renewal fee | Home users and small offices. SourceNext said in 2015 that the ZERO range had about 9.2 million users |
| Fudegurume | New Year card and address software | Households and small businesses |
| Meeting Owl | 360-degree conference camera made by Owl Labs; SourceNext has held exclusive rights to sell it in Japan since 2020 | Companies, for meeting rooms |
| Pocketalk | Two-way voice translator, sold through the subsidiary Pocketalk Inc. | Individuals, transport operators, local government and, in the US, public agencies |
BCN, 2017 (Japanese) · SourceNext, 2011 (Japanese) · SourceNext, 2015 (Japanese) · SourceNext disclosure on Meeting Owl, 2020 (Japanese) · Internet Watch, 2020 (Japanese)
Organizations that have announced using its products
Each of these was announced by the organization, SourceNext or Pocketalk, and confirmed in a second source where one exists.
| Organization | What was announced | When | Sources |
|---|---|---|---|
| JR Central | POCKETALK W at all 17 Tokaido Shinkansen stations: about 350 units for staff at ticket gates, ticket offices and platforms | October 2018 | JR Central (Japanese) · Impress Watch (Japanese) |
| ANA | Pocketalk for domestic ground staff, starting at Itami: 200 units planned across the 50 domestic airports it serves | December 2019 | Aviation Wire (Japanese) · BCN (Japanese) |
| Tokyo Metro | Pocketalk S for station service managers and five passenger information centres, including Tokyo and Ginza | From 1 January 2020 | Tokyo Metro (Japanese) |
| City of Osaka | 200 sets of Pocketalk S2 with the Pocketalk Analytics management console, supplied with Fujisoft, for the city's service counters | April 2025 | Fujisoft (Japanese) · Pocketalk (Japanese) |
| New Jersey Motor Vehicle Commission (US) | Handheld Pocketalk devices at every agency and on its mobile units, after a pilot in autumn 2025 | February 2026 | NJMVC · Pocketalk via PR TIMES (Japanese) |
Other rail operators were reported to have adopted Pocketalk between 2018 and 2020, among them Sotetsu, Keikyu and Tobu. We found only one report for each, so they are not in the table.
Being on this list does not mean an organization's data leaked. None of these organizations has said it is affected, and SourceNext has not said whether Pocketalk accounts are in the database. The exposure most likely to reach an organization is through its people: anyone who registered a SourceNext product, licence or device with a work address, a job title and a password they also use elsewhere.
If your organization buys from SourceNext or Pocketalk:
- Find your registrants. Search mail logs for past messages from SourceNext's domains to work addresses. Receipts and registration confirmations show who has an account.
- Ask procurement which SourceNext, Meeting Owl and Pocketalk purchases were made under company details, and who registered them.
- Start with those people. Reset their reused passwords, enforce multi-factor authentication, and send SourceNext the questions in the template below.
The second time in four years
In February 2023 SourceNext disclosed that a flaw in its website had let an attacker alter the payment application on its online shop. Card details of 112,132 customers and personal data of 120,982 customers entered between 15 November 2022 and 17 January 2023 may have leaked. It learned of it from a card company. Impress Watch, 2023 (Japanese) · ITmedia Mobile, 2023 (Japanese) · Security NEXT, 2023 (Japanese)
The two incidents hit different layers: the checkout page then, a member API now. What they share is a public-facing web component that handed data to someone who should not have had it, and detection that came days or weeks later. In 2023 the warning came from outside; this time SourceNext's own staff found it, but four days in.
The API pattern again
This is at least the third large Japanese disclosure in a week where data left through an interface built to serve members their own information. Lawson's app mechanism for showing users their own data was misused (our analysis). Skyticket's booking page returned bookings without a login. On 13 October Japan's National Institute of Information and Communications Technology (NICT) warned of “A2B” attacks: analyse a public app, then attack the servers behind it.
SourceNext has not said how its API was misused, and NICT has not linked any company's breach to that pattern. But an API that returns a member's record to whoever asks, at whatever rate, is the weakness NICT and JPCERT/CC have both described this month. Our 60-day review covers JPCERT/CC's alert of 8 October on app and API abuse.
What these fields make possible
- Credential stuffing. Email address and password pairs are tried against other services within days. Corporate users who reused a work password are the risk that reaches your organization.
- Convincing phishing. Name, address, phone number, date of birth and the products someone uses make a fake “SourceNext support” or “licence renewal” message easy to personalize. SourceNext warns of fake mail, SMS, calls and post.
- Targeted business email. Company name, department and job title tell an attacker who handles purchasing or IT. That is the raw material for invoice fraud and business email compromise.
- Identity checks. Date of birth, address and phone number are what many call centres use to verify a caller.
The attacker's playbook
How a red team would use this data and route. A model mapped to MITRE ATT&CK, not a reconstruction of this attack.
| Stage | What it could look like | ATT&CK |
|---|---|---|
| Find the API | Study the website and apps for the endpoint that returns member data, and how it identifies the caller | T1594 Search Victim-Owned Websites |
| Abuse it | Call it with weak or missing authorization, or with a stolen key, and walk through member identifiers | T1190 Exploit Public-Facing Application |
| Collect at scale | Script the calls and collect every record over days | T1119 Automated Collection; T1213 Data from Information Repositories |
| Turn passwords into logins | Try email and password pairs on email, cloud and shopping services | T1110.004 Credential Stuffing |
| Target companies | Use employer, department and title to pick finance and IT staff | T1589 Gather Victim Identity Information |
| Cash out | Fake support mail and calls, licence-renewal scams, invoice fraud | T1566 Phishing; T1656 Impersonation |
The defender's playbook
Response guide: the API data exposure playbook turns this API-risk discussion into 36 decisions, evidence checks and recovery gates. It separates credential abuse, object/field authorization and bulk functions; linking it here does not establish which mechanism occurred at SourceNext.
1. If your staff or customers use SourceNext
- Passwords. Change the SourceNext password, then every account that used the same one, work accounts first. SourceNext will require a reset at the next sign-in anyway.
- Sign-ins. Watch your own sign-in logs for one address failing against many accounts (query 1 and 4 below). Multi-factor authentication turns a guessed password into a blocked sign-in.
- Messages. Expect mail, SMS and calls that use SourceNext, Pocketalk or Fudegurume branding. Open the website yourself rather than following links.
- Finance teams. Staff whose employer and title were registered are likely targets for invoice and payment fraud. Repeat the call-back rule for any change of bank details.
2. If you run a member API
- Alert on volume per caller. Set a baseline of records or bytes per caller per hour, and alert on several times that baseline (query 2). Four days at around 66 records a second should not need a person to notice it.
- Make the API answer only for the signed-in member. Check on the server that the record requested belongs to the caller. Do not rely on the app to ask only for its own user.
- Return less. An API that shows a member their profile rarely needs to return a password field in any form, or the full record of anyone else.
- Cap and paginate. Rate limits per key and per address, and a hard ceiling on records per request.
- Plant canary records. Fake members whose email addresses alert when anything is sent to them tell you that your list is in someone else's hands.
3. Which teams should act
| Team | Scope | Next step | Evidence needed |
|---|---|---|---|
| IT Operations | Member APIs and sign-in services | Per-caller volume alerts, authorization checks, rate limits | Configuration, test results |
| SIEM / SOC | Sign-in, web and API logs since 9 October | Schedule queries 1, 2 and 4 | Query schedule, findings |
| Email Security | Mail naming SourceNext, Pocketalk or Fudegurume | Run query 3; block confirmed fakes | Message list, block records |
| Legal / Privacy | Staff and customer data held with SourceNext | Decide whether to notify staff; review the corporate licence agreement | Decision record |
| Third-party Risk | Software vendors with member portals | Ask the questions in the template below | Written answers |
Hunting
No indicators specific to SourceNext's incident have been published. These queries look for what follows a leak of email and password pairs, and for the API behaviour behind it, in your own logs.
All queries are illustrative and were not run against live data. Table and field names were checked against Microsoft's documentation on 15 October 2026 (JST). Expect noise from your own proxies, scanners and monitoring; list them as exceptions.
1. One address failing against many accounts, and who then signed in from it. Microsoft Sentinel, with Microsoft Entra ID sign-in logs (SigninLogs).
// Illustrative; not run against live data. Microsoft Sentinel, Microsoft Entra ID sign-in logs (SigninLogs).
// One address failing against many accounts, and any account that then signed in from it:
// the shape of credential stuffing with leaked email and password pairs.
let Start = datetime(2026-10-09T00:00:00Z);
let FailureCodes = dynamic(["50126", "50053"]); // 50126: invalid username or password; 50053: account locked
let TrustedEgress = dynamic(["REPLACE_WITH_CORPORATE_EGRESS_IP"]);
let Attempts = SigninLogs
| where TimeGenerated >= Start
| where ResultType in (FailureCodes)
| where not(IPAddress in (TrustedEgress))
| summarize FailedAccounts = dcount(UserPrincipalName), Failures = count(),
FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by IPAddress, Hour = bin(TimeGenerated, 1h)
| where FailedAccounts >= 10;
Attempts
| join kind=leftouter (
SigninLogs
| where TimeGenerated >= Start
| where ResultType == "0"
| summarize SignedIn = make_set(UserPrincipalName, 50) by IPAddress
) on IPAddress
| project Hour, IPAddress, FailedAccounts, Failures, FirstSeen, LastSeen, SignedIn
| order by FailedAccounts desc
2. A caller reading far more from a member API than it ever has. Microsoft Sentinel, W3CIISLog. For teams that run an API like the one misused here.
// Illustrative; not run against live data. Microsoft Sentinel, IIS logs (W3CIISLog).
// For teams that run a member API: a caller reading far more in an hour than its own peak over the previous two weeks.
// 22.5 million records in about four days is roughly 66 a second; volume like that should not pass unnoticed.
let MemberApi = @"(?i)REPLACE_WITH_MEMBER_API_PATH_REGEX";
let Lookback = 14d;
let Recent = 1d;
let Calls = W3CIISLog
| where TimeGenerated >= ago(Lookback)
| where csUriStem matches regex MemberApi
| where scStatus startswith "2"
| extend Caller = iff(csUserName == "-", cIP, csUserName)
| summarize Requests = count(), BytesOut = sum(scBytes) by Caller, Hour = bin(TimeGenerated, 1h);
let Baseline = Calls
| where Hour < ago(Recent)
| summarize PeakRequests = max(Requests), PeakBytes = max(BytesOut) by Caller;
Calls
| where Hour >= ago(Recent)
| join kind=leftouter Baseline on Caller
| extend PeakRequests = coalesce(PeakRequests, 0), PeakBytes = coalesce(PeakBytes, 0)
| where Requests > 3 * PeakRequests + 100 or BytesOut > 3 * PeakBytes + 10000000
| project Hour, Caller, Requests, PeakRequests, BytesOut, PeakBytes
| order by BytesOut desc
3. Inbound mail that names SourceNext or its products from other domains. Microsoft Defender XDR advanced hunting; needs Defender for Office 365.
// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail since 9 Oct 2026 that names SourceNext or its products but was not sent from its domains.
// SourceNext is emailing affected members and warns of fake mail, SMS, calls and post posing as the company or related parties.
let Since = datetime(2026-10-09T00:00:00Z);
let LurePattern = @"(?i)sourcenext|ソースネクスト|pocketalk|ポケトーク|筆ぐるめ|ウイルスセキュリティ";
let OfficialDomains = @"(?i)(^|\.)(sourcenext\.com|sourcenext\.co\.jp|REPLACE_WITH_OTHER_VERIFIED_SENDER_DOMAIN)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
EmailUrlInfo
| where Timestamp > Since
| project NetworkMessageId, UrlDomain
) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500
4. The same credential-stuffing check in Splunk. Uses the CIM Authentication data model.
| tstats summariesonly=true count AS failures dc(Authentication.user) AS accounts values(Authentication.app) AS apps FROM datamodel=Authentication WHERE Authentication.action="failure" earliest="10/09/2026:00:00:00" BY Authentication.src _time span=1h
| rename Authentication.src AS src
| search NOT src IN ("REPLACE_WITH_CORPORATE_EGRESS_IP")
| where accounts >= 10
| sort 0 - accounts
Downloads: stuffing KQL · API volume KQL · mail KQL · stuffing SPL
Other platforms. In Sumo Logic, for web servers that write Apache or Nginx combined logs, look for addresses posting to a sign-in page far more often than people do. Exclude your own monitoring.
_sourceCategory="REPLACE_WITH_WEB_SOURCE_CATEGORY" "POST" "REPLACE_WITH_LOGIN_PATH"
| parse regex "^(?<src_ip>\S+) \S+ \S+ \[[^\]]+\] \"POST (?<path>\S+) [^\"]*\" (?<status>\d{3})"
| timeslice 1h
| count as attempts by _timeslice, src_ip
| where attempts > 100
| sort by attempts
No results is not proof that nothing happened. Credential stuffing spread thinly across many addresses, or against services you do not log, will not show here. SigninLogs table · W3CIISLog table · EmailEvents
Copy-paste templates
Replace everything in [brackets]. Anything going outside the company should be checked by legal or privacy first.
Note to staff
Subject: SourceNext data leak – change reused passwords and watch for fake messages
SourceNext, which sells Fudegurume, security software and the Pocketalk translator, said on 15 October 2026 that member data may have leaked: up to 22,519,960 records with email addresses, passwords, names, addresses, phone numbers, dates of birth and, for some members, company name, department and job title.
- If you have a SourceNext account, change its password. SourceNext will also ask you to reset it at your next sign-in.
- If you used the same password anywhere else, especially for work, change it there too.
- Expect fake emails, texts and calls about SourceNext, Pocketalk or Fudegurume, licence renewals or refunds. Do not use links or numbers in the message; open the official website yourself.
- If you handle payments, follow the call-back rule for any request to change bank details.
- Report suspicious messages to [report button or address].
Questions: [security contact].
Questions for SourceNext (corporate customers)
Subject: [Company] – questions on SourceNext's notice of 15 October 2026
Please answer in writing by [date].
1. Which accounts and email addresses registered by our company or its staff are among the 22,519,960 records?
2. How were passwords stored (plaintext, encrypted, or hashed with which algorithm, salt and cost)?
3. How was the member-information API misused: missing authorization, a stolen key or credential, or a software flaw? Is it fixed, and how was the fix tested?
4. Over what period, at what volume, and from how many addresses was data taken? Will you share network indicators?
5. Were Pocketalk accounts, licence keys or product registration data included?
6. Have you seen the data offered for sale or used, including sign-in attempts against your own services?
7. What per-caller rate limits and volume alerts now apply to the API?
8. When will the final investigation report be available?
Thank you.
[Name, title, department]
Five-line briefing for management
1. What happened: SourceNext disclosed on 15 Oct 2026 that a member-information API was misused from 9 to 13 Oct. Up to 22,519,960 records may have leaked, including email addresses, passwords, dates of birth and, for some members, employer, department and title. Card data was not included.
2. Why it matters to us: staff who reused a SourceNext password at work are at risk of account takeover; finance and IT staff whose title was registered are likely phishing targets.
3. Our exposure: password-change notice sent [date]; credential-stuffing query scheduled [yes / date]; SourceNext-themed mail blocked [count].
4. Our own APIs: per-caller volume alerts on member APIs [in place / due date]; authorization tests [done / due date].
5. Decisions needed: [e.g. enforce MFA on remaining accounts; add canary records to customer databases]. Next update: [date].
What remains unknown
- How the API was misused: missing authorization, a stolen key, or a flaw, and how the attacker found it.
- How passwords were stored, and therefore how quickly they can be used.
- How much was actually taken. 22,519,960 is the number of records in scope.
- Whether Pocketalk accounts or licence data are included. In 2023 Pocketalk's own website was outside the scope; this notice does not say.
- Why it took four days to notice, and what monitoring existed on the API.
- Who is behind it, and whether the data will be offered for sale.
Sources and updates
- SourceNext: notice of unauthorized access and customer data leak (Japanese), 15 October 2026
- SourceNext: FAQ on the data leak (Japanese), 15 October 2026
- Nikkei (Japanese), 15 October 2026
- Impress Watch (Japanese), 15 October 2026
- ITmedia PC USER (Japanese), 15 October 2026
- Kyodo via Yahoo! News (Japanese), 15 October 2026
- Security Measures Lab (Japanese), 15 October 2026
- Impress Watch: SourceNext's 2023 incident (Japanese), February 2023
- OWASP API Security Top 10 2023
- Product lines and customers: the sources under “Who buys from SourceNext” above.
Related on this site: Skyticket and NICT's A2B alert · Lawson ID · 60-day review of Japan's breach notices · Customer account takeover playbook
15 October 2026, about 23:50 JST: retitled to lead with SourceNext's security-software business, and added “Who buys from SourceNext”: its product lines and the organizations that have announced using its products. Those sources were also read through search results. Customers that rest on a single news report are named but kept out of the table.
15 October 2026: first published. SourceNext's notice and FAQ were read through search results and news reports on 15 October (JST); we could not open SourceNext's pages directly from our research environment. Every figure was checked against at least two sources. The rate of about 66 records a second is our own arithmetic.
16 October 2026: added a link to the reusable API data exposure response guide; the incident's factual findings and uncertainties are unchanged.