Enjoying this article? Add us as a preferred source on Google.
Square Enix accounts are being hit by unauthorized logins. On October 19, 2026, Square Enix officially announced that it had confirmed cases of illegitimate logins using combinations of email addresses / account IDs and passwords believed to have leaked from other companies’ online services.
The notice is titled “Notice Regarding Unauthorized Access and Account Management.” It calls on two groups of users to change their passwords immediately: anyone reusing a password across services, and anyone using an easily guessable password such as the same character or digit repeated or a date of birth.
This is a classic credential-stuffing attack. Nothing leaked from Square Enix itself; attackers are taking combinations exposed elsewhere and brute-forcing their way through them. Which means “I only use Square Enix, so I’m fine” doesn’t hold up as an argument.
And this particular notice goes a step further, including a line about a password reset across all accounts. So what exactly is happening, and what should you do right now? Here’s the official notice, point by point.
What Is Happening? How the Unauthorized Logins Work
Email address / account ID and password combinations leaked from other companies’ services are being used to log in to Square Enix accounts. Square Enix announced this as a confirmed fact.
We have confirmed cases in which email addresses / account IDs and passwords believed to have been leaked from other companies’ online services (hereafter “other services”) are being combined and used to make unauthorized logins to customers’ Square Enix accounts.
Source:FINAL FANTASY XIV, The Lodestone
The key phrase is “leaked from other companies’ services.” This is not a case of data being pulled out of Square Enix’s servers. Someone brought in a list of IDs and passwords exposed on a different site and started working through it. By its nature, this is an attack where the key simply doesn’t fit if you weren’t reusing credentials in the first place.
Flip that around, and you get the real horror of password reuse: the moment one place leaks, every service you own goes dangerous at once. As a former otaku shop clerk who fielded plenty of account-trouble questions over the counter, I can tell you that people who get hit by this almost never know where the leak came from.
Is My Account at Risk? The Conditions That Raise Your Exposure
Square Enix listed two cases that carry a higher risk of damage.
- You use the same email address / account ID and password combination on your Square Enix account that you use on another company’s service
- Even if the combination isn’t used on another service, your password is easily guessable, such as the same character or digit repeated, or a date of birth
The second one is the easy one to miss. You may believe you aren’t reusing anything, but a predictable string still gets cracked by brute force. Sequences like 1111 or 19930401 are exactly what this covers. If that rings any bells, change it before you finish reading this article.
Square Enix is asking users who fall into either category to change their passwords immediately. The choice of “immediately” rather than “as a precaution” tells you something about the temperature in the room.
What Should You Do Right Now? Sorted by Priority
There are only three things to do: change your password, turn on the one-time password, and stop reusing credentials elsewhere.
- Change your password—use the official password reset page and switch to a string you don’t use on any other service. This comes first
- Set up a one-time password—a system that pairs your ID and password with a number that’s only valid for a short window. Square Enix recommends enabling it
- Clean up the reuse on your other services—if the same combination is in use elsewhere, those accounts are still sitting there exposed
On the one-time password, Square Enix explains that because the code is valid only for a limited time and becomes invalid once it has been used to log in, it is extremely effective against unauthorized access, and that using it alongside your ID and password dramatically improves security. In short, you’re adding one more layer that holds even if your password is already out there.
One-time passwords feel like a hassle, so they’re easy to put off. I’ll admit I used to do exactly that. But recovering a hijacked account is dozens of times more painful, and I saw plenty of that back in my shop days.
What Happens If Your Account Gets Login-Restricted? How to Lift It
Square Enix is applying login restrictions to accounts it believes have been compromised. When a restriction is in place, an email explaining how to lift it goes to your registered address, and you reset your password before logging back in.
So if you suddenly can’t log in, it may not be a service outage but a protective measure. The door has been closed ahead of you to stop the damage from spreading. Before you panic and hammer the login button, the right move is to check the inbox of the email address registered to your account.
One thing to watch out for here: phishing mail dressed up as that very notification is guaranteed to show up. The official notice spells out the pages for password resets and login restrictions, so it’s safer to navigate from the official notice than to tap a link inside an email.
Will There Be a Password Reset for All Accounts?
The possibility has been raised. Square Enix says that if unauthorized access continues to increase, it may carry out a password reset for all Square Enix accounts.
I read that as a fairly strong warning shot. A blanket reset across every account is a heavy measure that buries the operator’s own support queue, and the fact that they’re putting it in writing in advance suggests the current attack is running at some scale. That said, this isn’t an announcement that it has been decided, so for now it stays at the level of a stated possibility.
Change your password yourself first and there’s that much less to scramble over if a site-wide reset does land. There’s no particular reason to wait.
Enjoying this article? Add us as a preferred source on Google.
Summary: If You Reuse Passwords, Change Them Today
On October 19, 2026, Square Enix announced that it had confirmed unauthorized logins using combinations of email addresses / account IDs and passwords believed to have leaked from other companies’ online services. The notice is titled “Notice Regarding Unauthorized Access and Account Management.” It states that the risk is higher for users who reuse credentials and for users whose passwords are easily guessable—the same character or digit repeated, a date of birth—and asks them to change their passwords immediately.
Accounts suspected of being compromised have login restrictions applied, and an email explaining how to lift the restriction is sent to the registered address. Lifting it requires a password reset. Square Enix also recommends using a one-time password alongside your credentials, and notes the possibility of carrying out a password reset for all Square Enix accounts if unauthorized access keeps increasing.
This isn’t a leak out of Square Enix. Someone is walking in with a ring of keys stolen somewhere else. That’s exactly why the defense sits entirely on the user’s side, and why it matters that the official notice reaches for the word “immediately” and goes as far as floating a reset of every account. FINAL FANTASY XIV and the Mog Station both run on the same Square Enix account. Pull one thread and the blast radius widens instantly—that’s the structure worth keeping in mind.
Changing a password takes five minutes. Setting up a one-time password takes under ten. Ten minutes to protect the data you love is cheap, seriously.
Read Next
Nokko Oda
Leave a Reply