SourceNext (Japanese software seller) says it detected unauthorized access to its member-management system around 9:00 JST on Oct 13 and contained it by 13:36. Investigation found an attacker had been abusing its member-information retrieval API since about 10:00 on Oct 9. Up to 22,519,960 records may have leaked, with fields varying by member: email, password, name, address, gender, phone, fax, date of birth, company, title and department. Card data wasn't in that system. SourceNext invalidated every password and forces a reset at login. Its PR told Yahoo! News Japan the passwords were stored encrypted (not hashed) for integration with other systems and returned by the API, and that the system holding the key was breached, so they leaked in readable form. Anyone who reused a SourceNext password elsewhere should change it there. SourceNext reported to the PPC on Oct 15 and planned a police report on Oct 16.