Sony Network Communications DATA BREACH EXPOSING 2.58 MILLION SO-NET AND PLALA CUSTOMER RECORDS
Sony Network Communications, a Sony Group subsidiary that operates the Japanese internet service provider So-net, disclosed on October 27, 2026, that unauthorized access to its member database had exposed personal data from 2,585,481 current and former customer records.
The intrusion occurred on October 19. The company confirmed the unauthorized access on October 23, shut down the affected server, and blocked communications from the source. By October 24, investigators had determined that personal information had been taken and identified the scope.
What Was Exposed:
The leaked records break down as follows:
So-net: 2,141,986 records (1,869,771 current members + 272,215 former members who canceled in March 2026 or later).
plala (S Course): 443,495 records (422,365 current + 21,130 former). These relate to NTT Docomo’s Docomo Hikari fiber service, which uses infrastructure contracted through Sony Network Communications.
Exposed fields for these membership records included
Names
Phone Numbers
Email Addresses
User IDs,
Dates of birth
Gender
Internet connection IDs (IP ADDRESSES)
Membership passwords were not leaked.
Separately, attackers obtained both the email address and password for 54,401 accounts across four legacy So-net email services:
Mail Service (G): 24,655 (free; domains including gyao.ne.jp, gate01.com, pbc.ne.jp, and highway.ne.jp)
A-Box (additional mailbox): 17,672
So-net VAIO Mail: 7,005
PostPet Mail Account Service: 5,069
The company also confirmed that 16 bank account records were exposed (financial institution and branch details, account type, account number, and account holder name). Sony stated it does not hold PINs for these accounts.
Seven password-reset notification records were additionally involved.
No credit card data was stored or exposed, and the company reported no leaks affecting its NURO fiber service or other offerings.
Company Response:
Sony Network Communications apologized for the inconvenience and concern, reported the incident to Japan’s Personal Information Protection Commission, and began contacting affected customers individually. On October 27 it force-reset the compromised email passwords (starting around 10:00 a.m. JST), requiring users to set new ones via the So-net My Page portal before resuming service. It set up a dedicated FAQ and phone line, and warned customers about potential phishing or suspicious contacts exploiting the leaked information.
As of late October, the company said it had not confirmed secondary misuse of the data. The cause and full details of the intrusion remain under investigation, with a review of security and information management practices underway.
NTT Docomo was notified and issued its own customer communications regarding the plala (S Course) impact.
Concurrent Incident and Historical Context:
Around the same period, Sony Life Insurance disclosed a separate unauthorized access (detected October 27) affecting roughly 385,000 records related to Medicare Life Insurance policies it handled as an agent.
Leaked data included names, dates of birth, gender, addresses, phone numbers, policy numbers, and contract details, but not My Number, credit cards, or bank account information for premium withdrawals. Related web and app services were temporarily restricted while the investigation continued, with no confirmed misuse reported.
Sony has faced high-profile breaches before.
The 2011 PlayStation Network incident compromised data from approximately 77 million accounts and took the service offline for weeks, with estimated costs exceeding $170 million.
The 2014 Sony Pictures Entertainment attack (linked to North Korean actors and the film The Interview) involved massive data destruction and leaks of internal emails, employee Social Security numbers, and unreleased films.
A 2023 MOVEit vulnerability incident affected data of roughly 6,800 current and former employees.
The October 2026 So-net breach is notable for its scale in Japan’s consumer ISP market and the exposure of some email credentials and limited banking details, even as core membership passwords and payment cards were not involved. Affected users are advised to monitor accounts, change passwords where relevant, and remain alert to phishing. Sony continues to investigate and strengthen defenses.
