Sony Network Data Breach: 2.58 Million Customers’ Data Exposed

Sony Network Communications, the Sony Group subsidiary that runs the Japanese internet service provider So-net, said on 27 October 2026 that an attacker had broken into its So-net member database and exfiltrated personal data belonging to 2,585,481 current and former customers.

The stolen records cover 2,141,986 So-net members and 443,495 users of NTT Docomo’s “plala (S course)” fibre plan, and include names, phone numbers, email addresses and dates of birth, along with working passwords for 54,401 email accounts and bank account details for 16 customers, according to the company’s disclosure .

The intrusion took place on Monday, 19 October, but Sony Network Communications did not detect it until Friday, 23 October. On detecting it, the company shut down the affected server and blocked the attacker’s connections.

An investigation on 24 October confirmed that personal data had been taken and established which fields and how many records were involved. The company lists the cause only as unauthorised access by a third party, still under investigation, and has reported the incident to Japan’s Personal Information Protection Commission. So-net’s internet connectivity remained uninterrupted.

What data was stolen in the So-net breach

The So-net records belong to 1,869,771 current members and 272,215 former members who cancelled in or after March 2026. People who left So-net by the end of February 2026 are not affected. For each record, the attacker obtained the customer’s:

user ID used to log in to So-net’s My Page

Internet connection ID, the credential a router presents to the ISP

Sony Network Communications says no account passwords were in that dataset. Its customer FAQ specifies that My Page passwords, connection passwords and passwords for the free basic mailbox were not exposed.

Former customers are in the data because So-net keeps member records after cancellation to bill the final month and answer queries, the FAQ explains. That retention period put 293,345 people who had already left So-net or plala into the stolen dataset.

The more serious exposure is a set of 54,401 add-on and legacy email accounts whose addresses and passwords were both taken:

24,655 free “Mail Service (G)” addresses on the gyao.ne.jp, gate01.com, pbc.ne.jp and highway.ne.jp domains

17,672 paid A-Box extra mailboxes on so-net.ne.jp

7,005 paid Sonet VAIO Mail addresses on vaio.ne.jp

5,069 PostPet mail accounts

According to the FAQ, anyone holding those credentials could read, send and receive mail as the victim through a mail client or So-net Webmail. For that reason, the company forced a password reset from around 10am Japan time on 27 October, without notifying users in advance.

Bank details for 16 So-net customers were also exposed, including:

branch name and number

account type and account number

Sony Network Communications says it does not hold bank PINs. Separately, seven notification letters for password resets were leaked, and the company has reset the passwords for those accounts. No credit card data was involved, since the FAQ says the company does not store card information at all. Sony says its NURO fibre service and its other services outside So-net and plala (S course) are unaffected.

“We take the occurrence of this incident seriously,” the company said in its statement. It added that it will continue to investigate the cause and review its security measures and information management practices.

Why are NTT Docomo customers affected

Plala (S course) is a Docomo Hikari plan created for So-net fibre customers who switched to NTT Docomo while keeping their So-net email addresses and connection settings. Docomo stopped taking new sign-ups for it on 29 February 2024. Sony Network Communications still manages the IDs that those customers carried over from So-net, which is why their data ended up in the same database.

In its own notice on 27 October, Docomo described Sony Network Communications as its contractor. Docomo said it was told the breach on 26 October, the day before the public announcement. Docomo’s count matches Sony’s at 443,495 records, covering current plala (S course) users and those who cancelled within the past six months.

The leaked addresses for these customers are their so-net.ne.jp addresses, plus a separate address where one was registered, Docomo said. No passwords, card numbers or bank details belonging to these customers were taken. Docomo added that customers of its other plala services, including “plala (Docomo Hikari)”, are not affected.

What So-net and plala customers should do

Users of the four mail services listed above need to set a new password through So-net’s My Page . Mail will not send or arrive until they do. The new password must also be entered in Outlook or another mail app. The FAQ says the change usually takes effect within minutes, but can take up to 30. Anyone who used the same password on another site should change it there as well.

Other affected customers do not need to change their passwords. However, the name, phone number, birth date and email address now in an attacker’s hands are exactly what targeted phishing emails, scam SMS messages and fraudulent calls rely on. Sony Network Communications and Docomo both advise customers not to respond to unexpected messages or calls, and not to open links or attachments in such messages or calls. As of 27 October, neither company had seen any misuse of the data.

The company says it will affected customers individually. Its FAQ adds that it is still working out exactly who is in scope, and that customers whose bank details or notification letters leaked will be contacted directly. A dedicated So-net hotline, 0120-36-8887, operates from 10 am to 6 pm on weekdays and Saturdays. It also opens on 1 and 3 November.

This is not the first time So-net has been targeted. In May 2011, weeks after the PlayStation Network breach, So-net reported that an intruder had made around 10,000 attempts to break into its points service, an incident Sony said was likely unrelated to the PlayStation attack.

Several questions remain open. Sony Network Communications has not said how the attacker accessed the member database, why the intrusion went undetected for four days, or whether the stolen data has surfaced online or been accompanied by a ransom demand.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!