What happened
SourceNext, a major software developer, confirmed that up to 22,519,960 member records were compromised after attackers exploited a member-data API. The exposed data includes sensitive user information and passwords, leaving millions of accounts vulnerable to credential stuffing and identity theft.
Why this matters
This incident demonstrates the catastrophic risk of centralized databases. When a company stores millions of user records in a readable format, a single API vulnerability or misconfiguration becomes a goldmine for attackers. Once the data is exfiltrated, the damage is permanent, as users cannot change their personal history or identity markers as easily as they can reset a password.
How zero-knowledge changes this
Zero-knowledge architecture would have rendered this breach harmless. By utilizing client-side encryption, all user data is encrypted on the user's device before it ever reaches the server. Because the service provider never holds the encryption keys—which are derived locally from the user's device—the company stores only useless ciphertext. Even if an attacker successfully exploited an API to dump the entire database, they would only obtain encrypted blobs that are mathematically impossible to decrypt without the user's unique, non-bypassable credentials. In a zero-knowledge environment, the breach of a server does not equate to the breach of user data.