Japan's Hidden Data-Hoarding Problem, Laid Bare

The number everyone is quoting is only part of the story

Source Next, one of Japan’s largest software vendors, disclosed in mid-October that its systems were compromised and up to 22.51 million records may have been exfiltrated. The figure is staggering by any standard — second only to Japan’s 2022 Sony Pictures breach in scale among corporate data leaks in the country. Passwords were rotated. Public notices went out. Business moved on, as it always does in Japan, relatively quietly.

But 22 million is only the headline. The deeper story is why a company in the business of building software for law firms, accounting offices, and government contractors was sitting on that much data in the first place.

Who Source Next actually is

Source Next — ソースネクスト — is not a household name internationally, but in Japan it is a structural pillar. Its core products are the digital backbones of small-to-midsize professional practices: legal management software, tax and accounting suites, court document automation tools. Its customers are not consumers. They are organizations that handle other organizations’ most sensitive information by definition — client case files, financial records, regulatory filings.

When your software manages someone else’s secrets, the ethical baseline is to minimize what you collect and store. Source Next appears to have done the opposite on a scale that makes the breach feel almost routine rather than surprising.

What the leak actually contained

Japanese reports have been carefully vague about the specific fields exposed, which is unusual for a breach of this magnitude. What has been confirmed: user account information, including email addresses and hashed passwords, was compromised across the 22.51 million record ceiling. That ceiling spans multiple product lines, meaning the breach is likely aggregated — customer A’s database, plus customer B’s, plus older inherited datasets rolled into the same vulnerable infrastructure.

The hash of the password matter. Japan has a long history of enterprise password reuse. When hashed credentials from a single large software vendor leak, the blast radius multiplies because millions of users likely reuse the same credential across banking, government portals, and healthcare platforms. This is not speculation. It is the structural reality of Japanese enterprise IT.

Why the data was there at all

This is the question the breach raises but does not answer directly.

Japan’s enterprise software market operates on a cultural logic that foreign observers often misread. Vendors build deep relationships with individual companies and then maintain continuous data access under the assumption that retention equals service quality. Customer relationship management systems in Japan tend to accumulate years of unstructured data — meeting notes, transaction histories, internal communications — because the market has not yet disciplined itself around data minimization principles.

Source Next’s breach is not an anomaly of negligence. It is an anomaly of scale. Most Japanese software vendors probably hold less data. Most are probably just as careless. The difference between Source Next and its peers is the absolute number of records centralized on a single platform.

The regulatory gap

Japan’s Act on the Protection of Personal Information, revised in 2022 and strengthened further in 2024, does require data controllers to take “necessary and appropriate” security measures and to report breaches to the PPC (Personal Information Protection Commission). But the enforcement architecture remains fragmented.

There is no mandatory breach disclosure timeline comparable to the EU’s 72-hour GDPR window. There is no class-action framework that creates financial pressure on negligent vendors. The penalties for inadequate security are modest relative to the cost of actually securing the data. The result is a market where compliance is checkbox-driven and the economic incentive to hoard data without proportionate protection is rational from a vendor’s perspective.

Who wins, who loses

The victims of this breach are impossible to quantify precisely. Every Source Next customer who stored any identifiable information in its systems is exposed. That includes law firms managing criminal defense cases, accounting firms handling personal financial data, municipal contractors processing citizen records. The risk is not just identity theft in the American sense. It is reputational damage, client loss, and regulatory scrutiny for the firms that trusted Source Next with their data.

Source Next itself will absorb reputational costs and likely face a fine or two from the PPC. But it will survive. Japanese enterprise software markets are relationship-driven and switching costs are enormous. Law firms do not migrate their management systems lightly, even after a breach.

The winners, uncomfortably, are competitors who can position themselves as more secure. If any rival vendor in the legal-tech or accounting-software space has been investing in zero-trust architectures, encryption at rest, and strict data-retention policies, this breach is a free marketing opportunity. Japan’s enterprise software market is young enough that trust advantages can be real and conversion rates can follow quickly.

What happens next

Three things are likely in the months ahead.

First, the PPC will conduct an inquiry and issue guidance, which will be widely read and minimally enforced — the standard cycle. Second, affected law firms and accounting practices will face incoming client pressure, forcing some to review their own data-handling practices, which may trigger a slow wave of internal audits. Third, competitors will market the breach without explicitly naming it, relying on the vague but potent language of “security-first” positioning that is already resonating in Japanese enterprise purchasing decisions.

The broader pattern

Source Next did not become a data vault overnight. The company grew by accumulating features, integrations, and client databases across decades. Each new product added another dataset. Each dataset was stored, not curated. This is the default operating mode of Japanese enterprise IT: accumulate first, secure later, if ever.

The 22.51 million figure is not just a breach statistic. It is a balance sheet entry. And until Japanese regulators raise the cost of careless retention, and until enterprise buyers start penalizing vendors for excess data collection, the next Source Next is already being built.

Japan has many of them.