Verify Accounts After Massive Sourcenext Data Breach and API Exploits in Japan
A surge in cyberattacks across Japan has exposed millions of records, prompting official warnings and urgent checks for compromised credentials.
Key points
- Japanese agencies declared a cyber emergency after a 48% rise in attacks during the third quarter of 2026.
- The Sourcenext breach exposed over 22 million customer records via a misused member information retrieval API.
- Threat actors exploited known vulnerabilities, including a critical SQL injection flaw in the Metabase application.
The Sourcenext data breach and a broader wave of cyberattacks targeting Japanese organizations have exposed millions of individuals to credential theft and personal data leaks. These incidents involve compromised API endpoints, unpatched software vulnerabilities, and stolen cloud credentials, affecting sectors including retail, rail, logistics, media, education, and software. Users whose data was involved in these breaches face potential identity theft and unauthorized account access.
Root cause
Researchers attribute the surge in incidents to a combination of legacy system vulnerabilities, misconfigurations, and the misuse of application programming interfaces. According to Recorded Future, the attacks exploit known weaknesses in unpatched systems and internal or external APIs, sometimes using stolen credentials. Macnica Security noted that unauthorized access often results from weak authentication mechanisms or specific flaws in application design and access controls.
Attack path
Threat actors deployed a variety of techniques, including ransomware deployment, phishing-enabled account compromises, and the exploitation of web-facing systems. JPCERT/CC identified the deployment of web shells contained within .war and .jsp files on internet-accessible servers. Later reports linked these attacks to artificial intelligence agents that performed basic website scanning and executed extended attack sequences involving multiple tools and techniques.
Affected versions
The breaches impacted a wide range of organizations, with specific technical vulnerabilities highlighted by security agencies. JPCERT/CC warned of the exploitation of CVE-2026-72898, a SQL injection vulnerability in the Metabase application. This flaw carries a CVSS score of 10, indicating a critical severity level. Other incidents involved generic API misconfigurations and unpatched systems rather than specific versioned software defects.
Mitigation
- Patch systems immediately to address CVE-2026-72898 and other known vulnerabilities in web-facing applications.
- Review and secure API configurations, ensuring that member information retrieval endpoints require robust authentication.
- Remove unauthorized web shells from .war and .jsp files on internet-accessible web servers.
- Monitor for signs of AI-driven scanning and extended attack sequences involving multiple tools.
For customers and users
Individuals affected by these breaches should check whether their email addresses or phone numbers appear in recent data leak databases. Change passwords for any accounts associated with the compromised services, especially if those credentials were reused elsewhere. Enable multi-factor authentication on all important accounts to add an extra layer of security. Remain vigilant for phishing emails or messages claiming to be from support teams or government agencies, as attackers often use stolen data to craft convincing follow-up scams.
Background: Data leaks
No single entity is always responsible for data leaks. While external attackers often initiate breaches, internal negligence, misconfigured systems, and third-party vendors frequently cause exposure. Liability depends on contractual obligations, regulatory compliance, and whether the organization met established security standards. Understanding these layers helps you assign blame correctly and build better defenses.
Read the full guide: Who Is Responsible for Data Leaks: Accountability and Prevention
What to do and how to stay safe: Sourcenext
- Change passwords for any online accounts linked to the affected Japanese organizations or services.
- Enable multi-factor authentication on email, banking, and social media accounts to prevent unauthorized access.
- Monitor bank statements and credit reports for suspicious activity or signs of identity theft.
- Be cautious of unsolicited communications asking for personal information or urgent action.
Step-by-step guide: Unauthorized Access Prevention Checklist for Systems
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many records were exposed in the Sourcenext breach?
Approximately 22,519,960 customer records containing personally identifiable information were compromised in the Sourcenext incident.
What specific vulnerability was highlighted by Japanese security agencies?
JPCERT/CC warned of the exploitation of CVE-2026-72898, a SQL injection vulnerability in the Metabase application.
Did the number of cyberattacks in Japan increase in 2026?
Yes, reports of cyberattacks rose 48% between the second and third quarters of 2026, with September alone seeing 86 attacks.
