Sourcenext

Summary

Sourcenext experienced a data breach via its member-data API abused from October 9 to 13, exposing about 22.52 million records.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Sourcenext breach emerged within a broader wave of Japanese data compromises that had been building since early summer. Disclosed compromises of Japanese web systems increased from 62 in 2024 and 84 in 2025 to 119 by October 6, 2026, with 81 occurring after July 1. Times Car disclosed the first incident in the September 25–October 15 cluster, followed by numerous near-daily notices from retailers, restaurants, financial firms, logistics companies, media organizations, and other businesses. Sourcenext was among the companies affected during this period and announced its breach on October 15, 2026. The known unauthorized-access period ran for five days, from October 9 through October 13, ending two days before the disclosure.

Sourcenext’s member-data API was the entry point identified for the incident. The available reporting characterizes the abuse as occurring through the API rather than through a contractor, SaaS platform, or cloud provider, and places it in the broader pattern of internet-facing web services and member systems being exploited during the October wave. APIs supporting member applications and web services were involved in several major cases, including Sourcenext, skyticket, Burger King Japan, Yakiniku King, and Lawson. The source does not identify a specific vulnerability, authentication failure, or administrative operation used against Sourcenext, nor does it specify the individual data fields contained in the affected member records. It likewise does not report how Sourcenext first detected the abuse or what technical containment measures it completed.

The maximum number of records stated in connection with the incident was 22.52 million. This made Sourcenext the largest incident by maximum stated record count in the report’s table of major October disclosures, although a separate, older E-Store breach reported shortly afterward was slightly larger at approximately 23.36 million people. The scale of the Sourcenext exposure placed it among the largest member-data compromises discussed in the Japanese breach wave. Researchers tracking the incidents reported no confirmed bulk sale of the newly stolen Japanese data, and most affected companies reported no secondary damage. The source does not identify any subsequent fraud, account abuse, data sale, or other secondary harm specifically involving Sourcenext.

The disclosure formed part of a wider government and industry response to the breach wave. On October 13, during the period in which Sourcenext’s API was being abused, the National Institute of Information and Communications Technology warned about attackers reverse-engineering public mobile applications to identify backend APIs and exploit server-side weaknesses, a technique it referred to as an App-to-Backend attack. The National Cybersecurity Office, Financial Services Agency, NICT, and other bodies also issued advisories, while Japan’s Information and Planning Agency opened a special consultation desk on October 16 for organizations that had been or might have been affected by unauthorized access. The government did not declare a formal cyberspace emergency; the phrase originated from a ruling-party cybersecurity strategy meeting on October 9. Following Sourcenext’s October 15 notice, additional breach disclosures continued, including an estimated nine million cumulative records at email delivery provider Ymirlink on October 19.

On the same October 19 date, GMO Cybersecurity by IERAE published findings linking part of the wider campaign to attack infrastructure carrying traces of ARTEX, a Chinese-developed autonomous AI penetration-testing tool. That infrastructure had targeted approximately 20 Japanese companies, eight of which had disclosed breaches, but GMO did not name the victims or the threat actor, and the source does not attribute the Sourcenext incident specifically to ARTEX. No hacktivist group was linked to any of the October breach disclosures, and no individual or criminal organization was named as responsible for the Sourcenext API abuse.

Sources

Sources available to members: 1 source.