Square Enix is locking Final Fantasy 14 accounts after third parties logged into player profiles with stolen email and password combinations. The company posted the warning on the game’s official Lodestone news site on October 19 and asked players to change their passwords right away.
According to the notice, the login details “appear to have been obtained from other online services of other companies.” That points to credential stuffing, where attackers take passwords leaked from one site and try them on another. Square Enix has not said how many players are affected, and it has not named anyone responsible.
How Square Enix is protecting Final Fantasy 14 accounts
Square Enix is restricting access to any account it believes may be compromised. Owners of flagged Final Fantasy 14 accounts will receive an email at their registered address with instructions for resetting their password. The support site has a separate page explaining how the login restrictions work.
The company also warned that a wider measure may follow. If unauthorized access attempts keep rising, Square Enix says it may reset the passwords of all Square Enix accounts. That would reach every player with an account, not only the ones flagged so far.
What players should do now
Square Enix asks anyone who uses the same email or ID and password on other services to change their password immediately. The same advice applies to passwords that are easy to guess. In particular, the notice warns against recognizable character patterns and birth dates.
The company also recommends turning on One-Time Passwords. This system adds a single-use code to each login on top of the regular ID and password. Square Enix describes it as highly effective against unauthorized access. As a result, a leaked password alone is not enough to get into an account that has it switched on.
The same logic explains why reused passwords are the weak point here. When one service leaks its user data, every other account sharing that password becomes a target. Players who keep their Final Fantasy 14 accounts on a unique password are far less exposed to this kind of attack.
Breach or reused passwords?
DualShockers first reported the incident as a data breach of player account information. However, Square Enix’s own wording places the source of the stolen credentials outside its systems. The notice does not describe an intrusion into Square Enix servers, and it does not list any personal data beyond login details.
Still, the incident adds to a run of privacy problems for the MMO. In 2025, a mod revealed that Square Enix linked player profiles across alternate characters. As DualShockers points out, that system could let stalkers follow victims through their alts. Square Enix fixed the issue after player backlash.
Square Enix has not given a timeline for its investigation. Meanwhile, the password reset page and the One-Time Password setup guide are both linked directly in the Lodestone notice.