Square Enix could reset passwords for all Square Enix accounts if unauthorized login attempts keep rising, following confirmed account compromises affecting Final Fantasy 14 players. The company is already restricting access to accounts it believes have been compromised.
In its October 19 security notice, Square Enix says attackers appear to be using email addresses or account IDs and passwords obtained from other companies' online services. It has not announced that its own systems were breached, and the possible account-wide reset is a contingency, not an action it says it has taken.
Players whose logins have been restricted should receive an email at their registered address with instructions for resetting their password. Square Enix has not disclosed how many accounts have been affected.
The company is also urging anyone who reuses the same login credentials elsewhere to change their Square Enix password immediately. Its warning extends to easily guessed passwords, including those containing predictable character patterns or dates of birth, even when the full login combination differs between services.
Securing a login without losing access
Square Enix recommends enabling its One-Time Password feature alongside the usual account ID and password. This adds a six-digit verification code at login, so knowing the account's regular password alone is not enough to sign in.
Its official authenticator guidance supports free smartphone apps such as Google Authenticator and Microsoft Authenticator. Registration is handled through the Account Management System under Services and Options, then One-Time Password. New registrations for Square Enix's older Software Token app closed in November 2023; that closure does not prevent players from setting up an alternative authenticator.
Square Enix also tells players to record their Emergency Removal Password after registration and keep it somewhere safe. Losing access to the phone can otherwise leave players unable to log in to account-related services. The Emergency Removal Password lets them remove the authenticator when they cannot generate a login code, but it can only be viewed while logged in.
Square Enix also instructs players to remove the authenticator from their account before changing or upgrading their phone, then register it again on the new device.