SourceNext Lost 22.5 Million User Records — and the Passwords Were 'Encrypted,' Not Hashed
SourceNext's member database was abused through an API for four days, exposing 22.5M records. The worst part: passwords were encrypted, not hashed — and the decryptor was compromised. Reset yours everywhere you reused it.
The irony is hard to miss: SourceNext — the Japanese company behind Pocketalk translators and a line of security software — announced on October 15 that up to 22,519,960 member records may have leaked after attackers abused a member-information API for four days. Names, addresses, phone numbers, dates of birth, employers, job titles — and email-password combinations. The SourceNext data breach is one of the largest of the year, and it carries a lesson every engineer should already know: the passwords were encrypted, not hashed. And the program that decrypts them was compromised too.
The timeline is tight and damning. Unauthorized access began around 10:00 AM on October 9, exploiting an API used to retrieve member information. An employee spotted the anomaly on the morning of October 13; emergency measures to block external communications were complete by 1:36 PM that day. Four days of abuse before detection. No further access has been confirmed since, and credit card data wasn't on the affected system — the one piece of good news.
How the SourceNext Data Breach Happened
API abuse is the breach vector of the moment. Unlike a classic database hack, the attackers didn't break into SourceNext's servers in the traditional sense — they hammered a legitimate member-information endpoint and pulled data through it. This is the same pattern that keeps showing up in 2026's breach reports: an API built for convenience, with insufficient rate limiting or anomaly detection, quietly becoming a data-export pipeline for whoever bothers to ask nicely at scale.
Four days is a long time for an API to bleed 22.5 million records without anyone noticing. That points to a monitoring gap, not just a code bug. Somewhere, there should have been an alert for 'this endpoint is returning ten thousand times its normal volume.' There wasn't — or it went to an inbox nobody reads. The detection came from a human employee noticing something off, four days in. Automated anomaly alerts on data-export volume are one of the cheapest controls a company can deploy, and their absence keeps being the difference between a four-hour incident and a four-day one.
Encrypted Is Not Hashed — and It Matters
Here's the part that should worry you. According to Nikkei's reporting, the passwords were encrypted rather than hashed — and the program used to decrypt them was also compromised. NHK ran with the headline that the passwords leaked unencrypted. A careful technical analysis from security researchers notes the distinction matters less than it sounds: once passwords leak in a recoverable form, no later choice of hashing can save that batch.
For readers who don't live in password-storage land, the short version: hashing is a one-way transformation — you can verify a password against its hash, but you can't turn the hash back into the password. Encryption is reversible by design — anyone holding the key (or the decryption program) gets the plaintext back. Storing passwords encrypted means anyone who compromises the system and the key material gets every password in readable form. It's 2026; there is no excuse for reversible password storage, and SourceNext's breach is now the textbook example of why.
SourceNext took the extraordinary step of resetting every affected user's password and is asking anyone who reused the same email-password combination elsewhere to change it there too. If you have a SourceNext account — Pocketalk, their software, anything — assume your password is public. And if you reused it anywhere, that password is burned everywhere. This is the week to check a password manager migration off your list, not next month.
What This Breach Tells You About 2026
SourceNext isn't an outlier; it's a pattern. The same week's breach reports included Burger King Japan (11.18 million app members), Yamato Transport's Kuroneko pay-later service (5.26 million records, including purchase history back to 2018), and ShopServe's final count of 23.36 million people across 7,858 shops. The industry's list of 2026 breaches over a million records now has 29 entries. We're not in 'isolated incidents' territory anymore; we're in a steady-state leak economy where your personal data is compromised somewhere new every month.
The practical takeaway hasn't changed, even if nobody wants to hear it: assume breach. Use a password manager, give every site a unique password, turn on passkeys where offered, and treat your email address as semi-public. The October breach wave keeps proving the same point — the question isn't whether your data is out there, it's whether it's paired with a password you used twice.
