Square Enix told players of Final Fantasy XIV on October 19, 2026 to change their passwords immediately after confirming a wave of unauthorized logins tied to a credential stuffing attack. The notice, posted to the game’s official Lodestone site at 4:00 a.m. Japan time, makes Square Enix the fourth major gaming platform to issue a public account-security warning in October alone, following incidents at Discord, Steam, and PlayStation Network over the preceding three weeks.
The company did not disclose how many accounts were affected. But the pattern it described, attackers testing email addresses and passwords leaked from unrelated services against Square Enix’s login system, is the clearest sign yet that 2026 has become the year credential stuffing moved from a background nuisance to a front-page gaming story.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Square Enix Actually Said
According to the official Square Enix Support Center notice, the company “confirmed cases where attackers combined email addresses or account IDs and passwords believed to have leaked from other online services to attempt unauthorized logins to Square Enix accounts.” That is a textbook description of credential stuffing, a technique that does not require breaking into Square Enix’s own systems at all.
Square Enix said it had already placed accounts showing signs of unauthorized access under login restrictions to limit further damage. Players affected by those restrictions receive an email at their registered address with instructions to reset their password before logging back in. The company also added a second warning that reused passwords are not the only risk factor. Weak choices, such as repeated characters, sequential numbers, or birth dates, raise the odds of a successful guess even without a prior leak.
English-language coverage from Game Rant reported that Square Enix recommended enabling one-time password authentication and said the company could move to a broader, forced password reset across accounts if the volume of attempts keeps climbing. Square Enix has not confirmed a mandatory multi-factor rollout, and nothing in the notice suggests one-time passwords became compulsory on October 19. The advice remains a recommendation, not a requirement, at least for now.
How Credential Stuffing Attacks Actually Work
Credential stuffing gets confused with hacking in the popular sense, but the mechanics are closer to automated guesswork than intrusion. Attackers do not need a vulnerability in Final Fantasy XIV’s code. They need a list of real username-password pairs stolen from some other, unrelated breach, and a reason to believe a meaningful slice of those same people reused the password somewhere else.
Where the credentials come from
Leaked credential lists circulate widely after breaches at retailers, forums, loyalty programs, and smaller apps that never make national news. Criminal marketplaces compile these into combined lists sometimes running into the billions of lines, cross-referencing emails against every password ever associated with them across multiple incidents. None of that data needs to touch Square Enix for an attacker to try it against Square Enix.
How the automation spreads attempts
Instead of a person typing each combination, attackers run scripts or commercial credential-checking tools that fire thousands of login attempts per minute. To dodge basic rate limiting, the traffic gets spread across many IP addresses, often through residential proxy networks or compromised devices, and across different device fingerprints so the requests look like ordinary traffic from different people rather than one source hammering the login page.
A simplified version of the logic attackers automate looks like this:
for email, password in leaked_credential_list:
proxy = rotate_proxy()
response = attempt_login(target="account.square-enix.com",
email=email,
password=password,
via=proxy)
if response.success:
flag_account(email)
pause_briefly() # avoid tripping rate limits
Even a low success rate pays off at scale. If one in every few hundred attempts succeeds against a list of millions of stolen pairs, an attacker still walks away with thousands of working accounts to sell, loot, or use for scams aimed at the victim’s friends list.
Why Final Fantasy XIV Is a Valuable Target
Final Fantasy XIV remains one of the largest subscription MMORPGs still running in 2026, with years of accumulated player investment in that account: purchased expansions, cosmetic items, a subscription billing history, and sometimes a linked payment method. A hijacked account carries resale value on gray markets, and a login that still has an active subscription is worth more than a free one. That combination, long-term value plus a direct line to a stored payment method, makes subscription games a persistently attractive target for credential stuffing compared with free-to-play titles where an account has less built-in worth.
Square Enix accounts also function as a single login across multiple Square Enix properties, which raises the stakes further. A compromised account is not just a risk to one game’s progress. It is a foothold into whatever else is tied to that same credential set.
October’s Pattern: A Month of Gaming Account Warnings
Square Enix’s notice did not arrive in isolation. It capped a month in which four separate gaming-adjacent platforms issued account-security warnings or disclosed intrusions tied to login abuse, a frequency that security researchers describe as unusually dense even for an industry that gets targeted constantly.
Earlier in October, a Discord moderation bot called Double Counter, used for identity verification in more than 600,000 gaming communities according to reporting from EarlyGame, was compromised after an attacker found a way into an outdated, apparently forgotten server connected to the bot’s back end. From there the attacker reportedly pivoted into the bot’s cloud environment and exfiltrated close to 12 gigabytes of data in roughly 25 minutes, data that reportedly included user IDs, usernames, IP addresses, and coarse location information tied to an estimated 28 million Discord accounts. Separately, PlayStation Network users spent the first week of October swapping reports describing a pattern where support agents, not a technical exploit, became the weak point in two-factor verification. Steam had already pushed its own account-security guidance in late September.
TechRadar’s reporting on the broader gaming-security landscape also pointed to a large distributed denial-of-service event the prior October, suspected to be linked to the Aisuru botnet, that knocked Steam, Riot Games, PlayStation Network, and Xbox offline simultaneously, disrupting Counter-Strike, Dota 2, Valorant, and League of Legends at once. Taken together, the pattern suggests gaming platforms are absorbing attacks on multiple fronts at the same time, not just one kind of threat.
| Date (2026) | Platform | Incident type | Scale reported | Root cause |
|---|---|---|---|---|
| Sept. 23 | Steam | Account-security guidance issued | Not disclosed | Rising phishing and takeover reports |
| Sept. 29 – Oct. 6 | PlayStation Network | Alleged 2FA bypass via support agents | 8 separate player reports | Support-desk social engineering |
| Oct. 8 – 11 | Discord (Double Counter bot) | Third-party breach, data exfiltration | ~28 million accounts, ~12 GB stolen | Outdated parent/analytics server |
| Oct. 19 | Square Enix / FFXIV | Credential stuffing, unauthorized logins | Not disclosed | Password reuse from unrelated leaks |
How Big Is Credential Stuffing in Gaming, Historically
Square Enix’s October 19 notice did not come with industry-wide attack statistics attached, and no 2026-specific volume figures from a major security vendor were available at publication time. But the trendline behind this kind of attack in gaming has been documented for years. Akamai’s State of the Internet research recorded roughly 10.85 billion credential stuffing attempts against the gaming industry in 2020 alone, a 224% jump from the year before, with gaming accounting for about 6% of the 193 billion total web attacks Akamai tracked across every industry that year. An earlier Akamai security report had already logged around 12 billion credential stuffing attempts against gaming in a prior measurement window. Those figures predate the current wave, but they establish gaming as a long-running, high-volume target for exactly this attack type, not a new phenomenon Square Enix just discovered.
What has changed since those Akamai reports is the breadth of leaked-credential supply. Every unrelated breach at a retailer, airline, or forum adds more raw material to the lists attackers run against gaming logins, which is precisely the mechanism Square Enix described on October 19.
Square Enix’s Response Compared With Other Platforms
Square Enix’s playbook, restrict suspected accounts, email instructions, recommend but not mandate one-time passwords, mirrors how most large platforms have handled similar waves rather than breaking new ground. The differences show up in how aggressively each company pushes stronger authentication by default.
| Platform | Primary 2026 threat type | Account lockout response | Stronger-auth option | Mandatory MFA? |
|---|---|---|---|---|
| Square Enix / FFXIV | Credential stuffing | Restricts flagged accounts, emails reset link | One-time password (recommended) | No |
| Steam | Phishing, account-security guidance | Steam Guard device confirmation | Steam Guard mobile authenticator | No, but strongly pushed |
| PlayStation Network | Alleged support-desk 2FA bypass | Case-by-case account review | App-based 2FA | No |
| Discord (via third-party bot) | Third-party infrastructure breach | Not applicable, bot operator issue | Platform-level 2FA | No |
None of the four platforms in that comparison currently force hardware-backed or app-based multi-factor authentication on every account, which is the gap security researchers keep pointing to. Readers who want to close that gap themselves, rather than wait on a platform mandate, can follow the steps for setting up a WebAuthn passkey or a hardware security key, both of which make stolen passwords useless on their own because the attacker still lacks the physical device or key pair tied to the account.
Historical Context: Gaming Accounts Have Been a Target for Years
Account takeover in gaming is not a 2026 invention. Items, in-game currency, and rare cosmetics have carried real resale value on secondary markets for well over a decade, which is exactly why attackers bothered automating login attempts against gaming platforms long before credential stuffing became a mainstream security term. What has shifted is the raw supply of leaked credentials available to run against any given platform, driven by the sheer number of unrelated breaches at other companies that have nothing to do with gaming. Square Enix’s own framing of the October 19 incident, blaming credentials “believed to have leaked from other online services,” places this squarely in that long-running pattern rather than a one-off lapse specific to Final Fantasy XIV.
The broader entertainment and media sector has faced related pressure this year too. Security researchers at Mirage Security have tracked large-scale phishing campaigns in 2026 run by the Russia-linked group Star Blizzard, using lures such as fake tax notices and fabricated event invitations aimed at media and entertainment targets, a reminder that credential theft and phishing often function as two ends of the same supply chain feeding attacks like the one Square Enix just disclosed.
Market and Business Impact for Square Enix
Final Fantasy XIV is a subscription product, and subscription revenue depends on trust that an account, its billing details, and its years of collected content remain under the player’s control. A visible wave of account restrictions, even when framed as protective rather than punitive, creates support-ticket volume, player frustration over lockouts, and renewed scrutiny of why stronger authentication is not already mandatory for a game with a direct line to stored payment methods.
There is also a reputational dimension tied to timing. Square Enix’s notice landed in the same month as Discord’s much larger third-party breach, which means press coverage and player discussion naturally group the two together even though the attack types differ substantially: one is credential stuffing against Square Enix’s own login, the other is theft from a third-party bot’s infrastructure. Square Enix now has to communicate that distinction clearly or risk players assuming a breach occurred inside its own systems when the company’s description points instead to password reuse originating elsewhere.
What Security Experts Recommend Gamers Do Right Now
The advice for this specific incident does not differ much from standard account-hygiene guidance, but it carries more weight given the active attack described in Square Enix’s notice.
- Use a unique password for the Square Enix account, never one reused on another service, email provider, or retailer login.
- Turn on one-time password authentication now rather than waiting for a mandate, since Square Enix has already recommended it.
- Avoid passwords built from repeated characters, sequential numbers, or birth dates, which Square Enix specifically flagged as a separate risk even without a prior leak.
- Check for an unexpected restriction email from Square Enix’s registered sender before assuming it is a phishing attempt, then reset through the official support site rather than a link received elsewhere.
- Review linked payment methods and recent login history once back into the account.
- Consider a password manager to generate and store long, random, unique credentials for every gaming account rather than relying on memory.
The pattern of attacks hitting multiple sectors at once this year underscores why account-level protections like unique passwords and stronger authentication matter regardless of which platform gets hit next.
What Happens Next: Predictions
Several outcomes look likely in the weeks following Square Enix’s notice, based on how comparable incidents have unfolded at other gaming platforms this year.
- Square Enix will likely publish a follow-up notice within weeks confirming whether login restrictions have been lifted broadly or whether attempts are continuing, following the pattern set by its own October 19 wording that left the door open to a forced reset.
- Other subscription-based MMORPGs will face comparable credential stuffing attempts before the end of 2026, since the same leaked-credential lists get run against every plausible target, not just one game.
- Pressure will grow on Square Enix and similar publishers to make one-time password or app-based authentication mandatory rather than optional, echoing the direction Steam and other platforms have already leaned toward.
- Expect continued confusion in casual coverage between this credential stuffing incident and the separate, larger Discord third-party bot breach, simply because both surfaced in the same month and both involve gaming accounts.
- Security researchers will likely cite October 2026 as a case study in how fragmented account-security incidents across unrelated platforms compound into a single, harder-to-manage threat environment for the gaming industry as a whole.
Why This Keeps Happening Across the Gaming Industry
Credential stuffing persists for a simple reason: it is cheap to run and does not require finding a flaw in the target’s code. An attacker needs a leaked list and automation, both widely available, rather than a zero-day exploit. Gaming platforms sit at a disadvantage compared with, say, banks, because players resist friction that slows down logging in to play, which makes it harder to justify mandatory multi-factor authentication even when the security case is clear. That tension between convenience and protection runs through every platform named in this story, from Square Enix’s recommended-not-required one-time password to Steam’s optional mobile authenticator.
The supply-chain angle compounds the problem further. Even a company with strong internal security and no breaches of its own remains exposed if its players reuse passwords elsewhere, a dynamic that shows up clearly in how unrelated breaches at other companies keep feeding the credential lists attackers run against totally separate targets.
Frequently Asked Questions
Was Square Enix itself hacked on October 19, 2026?
No. Square Enix described a credential stuffing attack, meaning attackers used email and password combinations leaked from unrelated services elsewhere, not a breach of Square Enix’s own servers.
How many Final Fantasy XIV accounts were affected?
Square Enix has not disclosed a total number of affected or restricted accounts in its official notice or in subsequent coverage.
What should I do if my account shows a login restriction?
Check for an email from Square Enix’s registered support address, follow the official reset instructions in that email, and set a new, unique password before logging back in.
Is one-time password authentication now required for Square Enix accounts?
No. Square Enix has recommended enabling one-time password authentication, but it has not announced that the feature is mandatory for every account.
Is this connected to the Discord Double Counter bot breach earlier in October?
No. The two incidents are separate. The Discord-adjacent breach involved a third-party moderation bot’s infrastructure being compromised, while the Square Enix incident involves attackers reusing passwords leaked from other, unrelated online services.
What is credential stuffing, in simple terms?
It is an attack where someone takes a list of real usernames and passwords stolen from one website and automatically tries those same combinations on a different website, counting on people reusing passwords across services.
How can I check if my password has leaked elsewhere?
Several breach-notification services let you check whether an email address has appeared in known leaked-credential databases. If it has, change the password on every account still using it, starting with gaming and financial accounts.
Does using a unique password fully protect a Final Fantasy XIV account?
A unique password removes the specific risk Square Enix described on October 19, since reused credentials are what made the attack possible. It does not protect against phishing or malware that captures the password directly, which is why one-time passwords or a passkey add a separate layer of defense.
