Square Enix says third parties are trying reused credentials on Square Enix accounts. Here is what FFXIV players should verify now, and why one-time passwords matter.
Image: IGDB
Store links: Final Fantasy XIV Online on Steam, Final Fantasy XIV: Stormblood on Steam
Square Enix warns FFXIV players after unauthorized access attempts
Square Enix has warned Final Fantasy XIV players that it has confirmed instances of unauthorized access to Square Enix accounts, with third parties apparently using email addresses, account IDs, and passwords obtained from other companies’ online services. The notice, posted on the official Lodestone site, does not say Square Enix’s own systems were breached, and it does not disclose how many accounts were affected.
That distinction matters for anyone trying to decide how urgent this is. The company is describing a familiar account-security problem: attackers take login details exposed elsewhere and try them against another service, banking on reused passwords or guessable variations. For an MMO account, the risk is not abstract. Your Square Enix account is the gate to characters, subscriptions, purchases, social ties, housing, retainers, and years of progression. In FFXIV terms, this is not a warning to read later between roulettes. It is a maintenance window for your own login habits.
Square Enix says it is mitigating the attack by restricting access to accounts it believes may have been compromised. If your login has been restricted, the company says it will send instructions to the email address registered to your Square Enix account so you can reset your password. The company also warns that if unauthorized access attempts continue rising, it may initiate a password reset for all Square Enix accounts.
What Square Enix has confirmed, and what it has not
The confirmed facts are narrower than some third-party summaries suggest. On the Lodestone, Square Enix says third parties are using combinations of email addresses or account IDs and passwords that appear to have been obtained from other online services operated by other companies. It specifically warns that using the same email address or account ID and password combination for a Square Enix account as for another service increases the chance of unauthorized access.
Square Enix has not stated how many players were affected. Siliconera also noted that the company did not give an affected-account count in its coverage of the Lodestone notice. MMOHuts reported that the notice was posted on October 19, 2026, and summarized Square Enix’s advice as changing reused passwords immediately.
There is a conflict in how the incident has been framed elsewhere. A Rankiteo blog post labels the situation a “major data breach” and says unauthorized access to player account information occurred. The official Lodestone wording supplied here does not make that broader claim. It describes login attempts or access using credentials apparently obtained from unrelated services, and it says Square Enix is restricting accounts it believes may have been compromised. Based on Square Enix’s own notice, players should treat this as a serious Final Fantasy XIV login security incident, but not as confirmation that Square Enix suffered a new internal breach unless the company says so.
The password check players should do now
Square Enix’s immediate recommendation is simple: if your Square Enix account uses the same email address or account ID and password combination as another service, change the Square Enix password immediately. The company’s warning also covers passwords that are not identical to another login but are still easy to infer, including passwords built from discernible character or number patterns or a date of birth.
For FFXIV players, the most practical first step is to treat the Square Enix account as a high-value RPG save file. It should have its own password, not a reused password from a forum, shop account, old launcher, or social account. If the password is built around a memorable date, a character name plus a number, or a small variation of another password, Square Enix’s notice puts that in the risk category.
Square Enix directs players who need to update their credentials to its password reset page. If your account is already restricted, the company says instructions will be sent to the registered email address. That means the registered email account also becomes part of the recovery path. The Lodestone notice does not offer a separate checklist for email security, but it makes clear that the email address attached to the Square Enix account is where reset instructions will go if Square Enix locks the login.
Why one-time passwords are the strongest tool in this warning
Square Enix is strongly recommending One-Time Passwords for FFXIV accounts. In the Lodestone notice, the company describes One-Time Passwords as temporary verifications that authenticate a user for a single login, and says they are highly effective against unauthorized access when used alongside a login ID and password.
The value is in how the system changes the attacker’s job. A reused or guessed password can open the door if the account has only one layer of protection. A one-time password adds a second step that changes every login, so a stolen static password is less useful by itself. Square Enix has not made One-Time Passwords mandatory in the notice, and nothing in the supplied source material says a mandatory multi-factor rollout is happening. For now, this is a recommendation, not a requirement.
Siliconera reported that Square Enix also points players toward Software Authenticators and sells physical Security Tokens for use with FFXIV. Siliconera listed the official Security Token price at $14.99 and said the devices were sold out on the Square Enix Online Store at the time of writing. That leaves software-based authentication as the more immediately available route for many players, depending on the current availability shown through Square Enix’s own account-security pages.
Account security hits differently in a long-running MMO
FFXIV account security is a progression issue as much as a technical issue. A compromised account can affect the character you raid on, the Free Company you manage, the gil and items stored across retainers, and the housing or social identity attached to a server community. Square Enix’s notice focuses on protecting personal information and data, but MMO players understand that an account also holds time, reputation, and access.
That is why reused credentials are so dangerous in a game built around continuity. FFXIV asks players to return across patches, expansions, seasonal events, and long-term goals. An old password that once felt harmless can become a weak point years later if it was reused on a separate service that later leaked credentials. Square Enix’s warning is aimed directly at that pattern: attackers do not need to know your static rotation, your raid schedule, or your favorite job. They need a working login pair from somewhere else and a Square Enix account that accepts it.
There is also a practical community cost. If Square Enix sees enough rising unauthorized access attempts, it says a password reset for all Square Enix accounts may be initiated. A global reset would be disruptive, especially for players returning after time away or managing subscriptions across platforms. The cleanest way for individual players to lower their own risk now is to update weak or reused credentials before an account restriction forces the issue.
How to respond without overreading the warning
Players should act quickly, but they should not add unconfirmed details to the story. Square Enix has confirmed unauthorized access instances and account restrictions for accounts it believes may have been compromised. It has not provided a number of affected accounts in the supplied Lodestone notice, has not said all accounts are being reset now, and has not said One-Time Passwords are compulsory.
The right response is measured and immediate. Change your Square Enix password if it has been reused anywhere or if it follows an easy pattern. Watch the email address registered to your Square Enix account for official reset instructions if your login is restricted. Enable a One-Time Password through Square Enix’s account-security information if you have not already done so. If you planned to buy a physical Security Token, check current availability through Square Enix, since Siliconera reported the official device was sold out at the time it checked.
For a game where progress accumulates slowly and personally, login security is part of character stewardship. Square Enix’s account warning is a reminder that the weakest link may be outside Eorzea entirely: an old password from another service, brought back like a forgotten debuff at the worst possible pull.