2026 Square Enix — Final Fantasy XIV account takeovers via unauthorised logins; company says its own systems were not breached
Data compromised
Contents of affected player accounts may have been viewed or changed. Square Enix has not said how many accounts were affected.
Technical writeup
Company notice (Oct 19, 2026) as reported by OpenCritic, Kotaku and GamingHQ. Affected accounts were locked, users were emailed to reset credentials, and the company encourages one-time passwords. Square Enix says the logins did not come from a direct breach of its systems, so this is recorded as an account-compromise incident, which is in scope; the company’s own notice was not accessible to us. recordsAffected 0 (count not disclosed).
Root cause
Unauthorised logins to multiple FFXIV accounts. Coverage links them to credential stuffing, using login details believed to have leaked from other services. Square Enix has said this was not a direct breach of its own systems or databases.