Square Enix says third parties have broken into Square Enix accounts, the logins used for Final Fantasy XIV, using email addresses or account IDs and passwords that “appear to have been obtained from other online services of other companies.” The warning went up on the FFXIV Lodestone at 03:40 UTC on October 19. Square Enix is locking accounts it thinks are compromised and says it may reset every account’s password if the attempts keep rising. If your FFXIV account security depends on a password you use anywhere else, change it now.
Table of Contents
What Square Enix says happened
The notice, titled “Precautions for Guarding Against Unauthorized Account Access” and tagged Important, describes credential stuffing. Attackers take email and password pairs leaked from other companies and try them on Square Enix logins. Square Enix does not say how many accounts were accessed, and it does not report a breach of its own systems. It names reused credentials as the weak point.
Even a password that is not an exact copy can be risky. The company says accounts are still at “high risk” if the password follows easy patterns of letters or numbers or contains your date of birth. Siliconera notes that the notice appeared in English and Japanese.
Ishgard in Final Fantasy XIV. Square Enix accounts hold years of progress across FFXIV and FFXI. Image: Square Enix
What Square Enix is doing
- Login restrictions: accounts it believes may be compromised are blocked from logging in. The owner gets an email with instructions to reset the password.
- Both MMOs are affected: according to Square Enix’s support FAQ on login restrictions, a restriction covers FFXI and FFXIV if both are on the same Square Enix account. The FAQ adds that a restriction “does not directly indicate that the account was compromised.”
- Only you can lift it: the FAQ says the Support Center cannot remove a restriction for you. You lift it by resetting your password.
- A possible global reset: if unauthorized attempts keep rising, Square Enix “may” reset the password on every Square Enix account.
How to secure your FFXIV account now
These steps come from Square Enix’s own notice and support pages:
- Change your password if it is reused or easy to guess. Use Square Enix’s official password reset page and choose a password you have never used on another service. The company’s prevention guide warns against clicking suspicious links, so reach the page by typing secure.square-enix.com yourself.
- Turn on One-Time Passwords. New registrations for the Square Enix Software Token app closed on November 21, 2023. Today the free route is a Software Authenticator such as Google Authenticator or Microsoft Authenticator. Following Square Enix’s setup guide, log in to the Square Enix Account Management System and open “Services and Options”, then “One-Time Password”. Pick “Software Authenticator”, scan the QR code with the app, then enter the six-digit code it shows.
- Save your Emergency Removal Password. Square Enix shows it under “Token Usage Status” in the account management system. You need it to remove the authenticator if you change or lose your phone. Without it, you are locked out until support verifies you own the account.
- Check the basics. Square Enix says it will never ask for your password without a clear reason. It also tells players to avoid unauthorized third-party “helper” programs and to keep Windows and antivirus software up to date.
Square Enix also sells a key-ring Security Token for $14.99. When we checked its North American store page at 15:57 UTC on October 19, it showed a “Sold Out” badge, so the free authenticator app is the faster option.
The primal Ifrit in Final Fantasy XIV. A login restriction blocks both FFXIV and FFXI on a shared account. Image: Square Enix
Why it matters
An FFXIV account holds years of progress, a paid subscription and, for some players, a house. Credential stuffing works whenever one password protects many services. It is the same reuse problem that affects every online platform, not a Square Enix-only flaw. The threat of a global reset is the main thing to watch. If it happens, every player would need a new password before logging in. That is easier to handle if you already control the email address on your account. For more Square Enix news, see our guide to the Final Fantasy Resonance release date, price and editions. Earlier gaming security incidents include the 780 GB data theft at Electronic Arts and the Apex Legends “Save Titanfall” hack.
What’s next
Square Enix has not given a date for any global reset. It has only said one may follow if attempts keep growing. Watch the Lodestone notices page and the email address on your account. We will update this story if the company widens the response. For more of today’s stories, see our gaming news live page.
Sources: FFXIV Lodestone (Oct 19 notice), FFXIV Lodestone (Sep 15 token notice), Square Enix Support Center, Square Enix One-Time Password page, Square Enix Store, Siliconera.
Live: Follow today’s gaming news as it happens
Featured image: Square Enix
