SOURCENEXT: Why Passwords Leaked in Plaintext — 'They Were Encrypted, but a System with Access to the Keys Was Breached'

What happened

Sourcenext, a Japanese maker of software, had its member information API (a way for computer programs to talk to each other and share data) hacked. The attacker got names, addresses, and passwords. Sourcenext first said the passwords were encrypted. Now it says the attacker was able to reach the system that holds the key to unlock those passwords, so the passwords were stolen in readable form.

Key facts

• Up to about 22.52 million records may have leaked.
• The leak included names, addresses, and passwords.
• The company says the decryption key itself was not stolen.
• Sourcenext has forced a password reset for all customers.

Encrypted vs. plain text

Good systems do not store passwords as plain text. They use hashing, which turns a password into a scrambled code that cannot easily be turned back. Encryption can be undone with a key. Sourcenext used encryption, and the key was reachable through the same system the hacker entered. So the hacker could unlock the passwords. The company says the system was old and still used an older method that it had not moved away from.

Why it matters

Many people use the same password on many sites. If a password leaks in readable form, attackers can try it on other services. Users should change their Sourcenext password and any other site where they used the same one. The company has not said how it will store passwords in the future, and it has not shared details of its security fixes.

What to watch

• Whether Sourcenext explains how it will store passwords in the future.
• Results of the investigation by government and other authorities.
• Whether more customers report misuse of their accounts.
• Whether the company's explanation of the API's purpose changes.