BODY: If you have not touched your Final Fantasy XIV password since Heavensward, now is the moment.
Square Enix posted a notice titled "[Important] Caution Regarding Unauthorized Access and Account Management" to the FFXIV Players' Site on October 19. The company says it has confirmed cases of unauthorized logins to Square Enix Accounts using email address, account ID and password combinations believed to have leaked from other companies' online services โ not from Square Enix itself. In other words, this is credential stuffing: attackers taking username-password pairs dumped from one breach and firing them at every other login screen that will accept them.
The players most at risk, the notice says, are those who reuse the same password across services, and those using easily guessed passwords โ birthdates, repeated characters, repeated digits. Accounts showing signs of compromise have already had login restrictions applied, with unlock instructions sent to the registered email address. Square Enix also warned that if unauthorized access continues to climb, it may force a password reset across all Square Enix Accounts โ a significant escalation that would lock out even untouched accounts until they re-authenticate.
The recommended defense is two-step verification. Square Enix supports its own Security Token as well as Google Authenticator and Microsoft Authenticator, and the notice pointedly reminds players that authenticator apps cost nothing to set up. Guidance on enabling one-time passwords is available through the Square Enix Account management portal.
The insider take
Two things stand out from Tokyo. First, Square Enix declined to name the leaks it believes are feeding the attacks โ standard practice for Japanese companies, who rarely point fingers at another firm's incident, and a reminder that Japan has been working through an unusually heavy run of data exposure disclosures. Second, the Square Enix Account is a single key to a very large house: FFXIV, Dragon Quest X, mobile titles, and stored payment details all sit behind it.
Originally reported by GAME Watch (Japanese).