--- title: "Square Enix warns of logins with reused passwords · camada" description: "Square Enix says attackers got into accounts with passwords from other services. It published no count and says a full password reset is possible." url: https://www.camada.app/blog/square-enix-password-reuse-logins last_updated: 2026-11-04 --- # Square Enix warns attackers are logging in with reused passwords The camada team · October 20, 2026 · 3 min read ## TL;DR - Square Enix says attackers got into accounts using login pairs that appear to come from other services. - It restricts suspect accounts, published no count, and says it may reset all account passwords if attempts keep rising. - Your login faces the same risk. Count failures across accounts and IPs, and test that your MFA works. Attackers have got into Square Enix accounts with login details, [the company said on October 19](https://na.finalfantasyxiv.com/lodestone/news/detail/a9a69ce0a631fade329d628fc92e047712617b25). It says the emails, account IDs and passwords appear to come from other companies’ services. The notice sits on the Final Fantasy XIV site but covers Square Enix accounts in general. Square Enix does not use the term, but that describes credential stuffing: attackers take pairs stolen elsewhere and try them on your login. Your database can be clean and your customers can still lose their accounts. The notice is thin. It gives no count of affected accounts, no attack dates and no source for the passwords. It does not say which login the attackers used. Square Enix runs a [public web login](https://support.na.square-enix.com/faqarticle.php?id=496&la=1&kid=12867) for its account system. ## What Square Enix did It restricts accounts it believes may be compromised. Owners then get reset instructions by email. It tells anyone with a reused or guessable password to change it now. It also warns that if attempts keep rising, it may reset the password on every Square Enix account. That last line is the one to watch, though the notice does not say a reset has started. ## Eleven years of the same warning The Lodestone still carries much the same notice from [October 2022](https://na.finalfantasyxiv.com/lodestone/news/detail/2ff694b6ba8ef60084d28ca1e0819f9200fcb0a7) and [September 2015](https://na.finalfantasyxiv.com/lodestone/news/detail/7360774bfa00f42c1264a0d58b41eaefc2aeef7b). Both blame passwords from other services. Both raise the same all-account reset. All three also recommend one-time passwords, and that is the part we would change. Square Enix’s [own support page](https://support.na.square-enix.com/faqarticle.php?id=5382&la=1&kid=68228) calls a token the best way to secure an account, yet this notice only recommends one. [Siliconera reported](https://www.siliconera.com/square-enix-warns-about-unauthorized-ffxiv-account-access/) that its $14.99 hardware tokens were sold out at the time of writing. Square Enix also supports software authenticator apps. Asking people to stop reusing passwords has had eleven years to work. ## What to do The [New York Attorney General’s guide](https://ag.ny.gov/publications/business-guide-credential-stuffing-attacks) covers this attack well. For your own login: - Count failed logins across accounts and across IPs. The guide warns that attackers who rotate proxy IPs can often evade rate limits. - Offer MFA, then test that it works. The guide describes a business that lost more than 140,000 accounts because it set up MFA wrong. - Block passwords already known to be compromised when users sign up or reset. - Do not treat a quiet support queue as proof that you are safe. The guide says low fraud reports prove little. - Alert the old address when an account’s email changes. A reset email helps nobody if the attacker already replaced the address, and Square Enix tells victims to update theirs. Decide now what would make you reset every password, and who makes that call. ## Sources - [Square Enix: Precautions for Guarding Against Unauthorized Account Access (October 2026)](https://na.finalfantasyxiv.com/lodestone/news/detail/a9a69ce0a631fade329d628fc92e047712617b25) - [Square Enix: the same warning from October 2022](https://na.finalfantasyxiv.com/lodestone/news/detail/2ff694b6ba8ef60084d28ca1e0819f9200fcb0a7) - [Square Enix: the same warning from September 2015](https://na.finalfantasyxiv.com/lodestone/news/detail/7360774bfa00f42c1264a0d58b41eaefc2aeef7b) - [Square Enix Support: account login page](https://support.na.square-enix.com/faqarticle.php?id=496&la=1&kid=12867) - [Square Enix Support: what to do with a compromised account](https://support.na.square-enix.com/faqarticle.php?id=5382&la=1&kid=68228) - [Siliconera: Square Enix warns about unauthorized FFXIV account access](https://www.siliconera.com/square-enix-warns-about-unauthorized-ffxiv-account-access/) - [New York Attorney General: business guide for credential-stuffing attacks](https://ag.ny.gov/publications/business-guide-credential-stuffing-attacks) ## Would camada have helped? If your login reports failures with track(), camada can find a client failing across many accounts, and your SDK blocks it on later requests. First tries still reach your login, so a reused password can work, and attackers rotating IPs can retry from fresh addresses. camada does not check breach lists or replace MFA. [Credential stuffing protection that knows which logins failed →](https://www.camada.app/use-cases/credential-stuffing) [How camada works →](https://www.camada.app/how-it-works) ## Sitemap [Every page on this site](https://www.camada.app/sitemap.md)