The antivirus file had the password

The company that sells the lock mailed the keys.

Sourcenext said today that a third party reached the system that holds member records. It saw the access at about 09:00 on 13 October, cut the path, and says containment was done by 13:36 the same day. The look-back put the start at about 10:00 on the 9th. The method in the notice is a member-information API used the wrong way. The ceiling is 22,519,960 records. The field list: email, password, name, name in kana, address, gender, phone, fax, date of birth, company, title, department, and system identifiers such as which product and when they last logged in. Not every row has every field. Cards are not stored in this system.

They have forced a password reset on login. They told the Personal Information Protection Commission today and said they would file with the police tomorrow. They will mail the people in the file.

What 22 million will be asked to cover

It will be briefed as “the antivirus vendor lost every Japanese card.” The notice does not have a card. It will be briefed as a hash. The company wrote password, and it is asking people to reset this one and the one they reused. That is the incident. A security-product brand on the letterhead is not a finding that the endpoint agent was the door.

If you have a Sourcenext login, change the password you used elsewhere before their mail arrives. Their reset screen is the one that appears when you log in. A mail that asks you to “confirm the 22 million” is someone else. Phone-only customers of a different shop are not in this API.

They sell software that tells you not to reuse a password. The file that left is the reuse list.