Square Enix warns Final Fantasy 14 players after unauthorized account access

Square Enix has warned Final Fantasy XIV players to review their account security after confirming instances of unauthorized access involving credentials apparently obtained from other online services. The company posted the warning on October 19 and is restricting access to accounts it believes may have been compromised.

The incident does not currently appear to be a breach of Square Enix's own systems. Square Enix says third parties are attempting to enter accounts with email addresses and passwords believed to have come from breaches or leaks involving other companies.

Square Enix specifically warned players against using the same email address and password combination across multiple online services. If credentials stolen elsewhere match those attached to a Square Enix account, attackers can potentially use them to gain access without needing to compromise Square Enix directly.

Easily guessed passwords can also leave accounts exposed even when they are not identical to credentials used elsewhere. Square Enix identified recognizable patterns and personal information such as dates of birth as examples players should avoid when creating passwords.

Square Enix is temporarily restricting login access to accounts it believes may have been compromised. Players affected by one of those restrictions should receive an email at the address registered to their Square Enix account containing instructions for resetting their password.

The company has also warned that its response could become broader if unauthorized access attempts continue increasing. Square Enix says it may initiate a password reset across all Square Enix accounts if the number of attempts continues to rise, although it has not announced that such a reset is happening yet.

Players using a reused or easily guessed password are being advised to change it immediately. Square Enix also recommends enabling its One-Time Password system, which adds another authentication step when logging into an account and makes a stolen password alone less useful to an attacker.

The October 19 notice is particularly relevant to Final Fantasy XIV because a Square Enix account can contain years of character progression and access to paid services. Players who receive a login-restriction email should follow Square Enix's account recovery process, while those who can still sign in normally can reduce their exposure by using a unique password and enabling additional authentication.

Square Enix has not disclosed how many accounts have been accessed, nor has it said that passwords were taken from its own infrastructure. The confirmed issue is unauthorized access using credentials believed to have originated from other services, with account restrictions and a possible wider password reset being used as safeguards while the activity continues.