Sourcenext: what 22.5 million potentially exposed records mean

Incident discovered on October 13, 2026; first communication on 15. Sourcenext announces 22,519,960 records potentially affected by unauthorized access to one of its servers. The important word is “potentially”: this total is an estimate of records that may have been exposed, and the company does not say that it corresponds to so many distinct people whose every field was accessed.

Which fields, for which accounts?

Sourcenext lists the possible fields: email address, password, name, postal address, telephone, date of birth, company data and service-specific identifiers. It specifies that not all of these fields concern all customers; the composition depends on their registration. It indicates that credit cards were not stored in the affected system. People registered before October 13 at 1:36 p.m. are within the information scope described by the provider.

A number of records is not automatically a number of compromised accounts, usable passwords, or unique people. To qualify the impact, a breakdown by table, by type of secret and by confirmed extraction status would be required. The public FAQ does not provide this level of proof. It also does not specify whether the passwords were stored in plain text, hashed or otherwise protected; we must avoid transforming the sole mention “password” into a clear storage statement.

The technical risk that remains

If an exposed password is still valid and reused elsewhere, it can fuel login attempts on other services. Contact details and service history allow emails that include the name of a product actually purchased. The precise risk depends on the type and validity of the secret for each account. Defensive analysis involves invalidating affected sessions and passwords, looking for abnormal logins, examining account recovery attempts, and notifying customers about the data categories relevant to them.

Sourcenext indicates that it has corrected the weakness in the system at the origin of the access, gradually deactivated the passwords of the accounts concerned and requested external expertise on October 16. Its FAQ does not publish an actionable description of the flaw, CVE, or evidence of compromise of the software products themselves. The company clarifies that 1Password data is not hosted by it and is not included. This is an example where editorial discipline consists of explaining what the report measures, then limiting the unknown, rather than inferring an undocumented exploit.

Main source: Sourcenext incident FAQ.