Square Enix issued a warning to subscribers concerning unauthorized account access stemming from shared credentials. The ffxiv credential stuffing issue appears to stem from the same email addresses and passwords being used for multiple accounts across different services and companies. To protect your characters and service account, Square Enix recommends securing your credentials using official authentication tools.
What triggered the security alert
Unauthorized logins appeared to stem from identical email addresses and password combinations being reused across different companies and platforms. Square Enix published notices on the Lodestone in English and Japanese alerting players to the breach attempts.
The publisher is contacting affected players directly with password reset notices, with the possibility of distributing reset notices across all Square Enix accounts as a safeguard. Additionally, Square Enix removed the legacy Security Question and Answer fields from accounts on February 24, 2026, dropping that verification method entirely.
How to secure your Final Fantasy XIV account
Square Enix recommends defensive measures such as a unique user ID and password, one-time passwords, and two-factor authentication to lock down accounts.
- Unique user ID and password: Create a dedicated Square Enix ID and password pairing that you have never used on any other website.
- One-time passwords: Turn on one-time password protection to block access attempts made with exposed login info. Entering these 6-digit codes requires speed: token codes rotate every 30 seconds, while one-time passwords expire after 60 seconds.
- Two-factor authentication: Activate two-factor authentication (2FA) with a Software Authenticator or a physical Square Enix Security Token. Using an authenticator may also prevent automated temporary login restrictions from being applied.
If you plan to manage optional purchases alongside account updates, review the FFXIV Online Store: How to Buy and Gift Safely guide.
What to do if access is disabled
Square Enix may temporarily disable account access as a security measure when suspicious login attempts occur.
Check your registered inbox for an email from Square Enix detailing how to remove the temporary block. If no instructional email arrives, use the official password reset function to regain control of your account. For forgotten Square Enix IDs, log into your account using your email address to view the ID at the top of the interface.
