Attackers have got into Square Enix accounts with login details, the company said on October 19. It says the emails, account IDs and passwords appear to come from other companies’ services. The notice sits on the Final Fantasy XIV site but covers Square Enix accounts in general.
Square Enix does not use the term, but that describes credential stuffing: attackers take pairs stolen elsewhere and try them on your login. Your database can be clean and your customers can still lose their accounts.
The notice is thin. It gives no count of affected accounts, no attack dates and no source for the passwords. It does not say which login the attackers used. Square Enix runs a public web login for its account system.
What Square Enix did
It restricts accounts it believes may be compromised. Owners then get reset instructions by email. It tells anyone with a reused or guessable password to change it now. It also warns that if attempts keep rising, it may reset the password on every Square Enix account.
That last line is the one to watch, though the notice does not say a reset has started.
Eleven years of the same warning
The Lodestone still carries much the same notice from October 2022 and September 2015. Both blame passwords from other services. Both raise the same all-account reset.
All three also recommend one-time passwords, and that is the part we would change. Square Enix’s own support page calls a token the best way to secure an account, yet this notice only recommends one. Siliconera reported that its $14.99 hardware tokens were sold out at the time of writing. Square Enix also supports software authenticator apps. Asking people to stop reusing passwords has had eleven years to work.
What to do
The New York Attorney General’s guide covers this attack well. For your own login:
- Count failed logins across accounts and across IPs. The guide warns that attackers who rotate proxy IPs can often evade rate limits.
- Offer MFA, then test that it works. The guide describes a business that lost more than 140,000 accounts because it set up MFA wrong.
- Block passwords already known to be compromised when users sign up or reset.
- Do not treat a quiet support queue as proof that you are safe. The guide says low fraud reports prove little.
- Alert the old address when an account’s email changes. A reset email helps nobody if the attacker already replaced the address, and Square Enix tells victims to update theirs.
Decide now what would make you reset every password, and who makes that call.