Sony Life Insurance has issued a second breach notice, published on 9 November. It says about 2.9 million records from its own insurance policies were exposed when attackers broke into its policyholder website and related systems. CyberSIXT and BigGo Finance both report the new figure. The company's first notice, on 28 October, covered only about 385,000 records. Those belonged to Medicare Life Insurance policies that Sony Life sold as an agent. Both outlets say the total disclosed so far is now more than 3.2 million records. The two reports word it differently. CyberSIXT says the 2.9 million records "had leaked", while BigGo says they "may have" been exposed. Sony Life counts policy records, not people, so the number of individuals affected is not known. No attacker has been named and the way in has not been disclosed.
What Happened
Sony Life found on 27 October that a third party had accessed its Customer Web Service (お客さまWEBサービス) and other systems. Policyholders use that site to view their contracts and update their address and phone number. Japanese breach tracker 情報漏えい.jp and security outlet セキュリティ対策Lab both report that at 08:00 on 28 October the company blocked outside access to the affected systems and suspended six online services, with no date set for restoring them:
- the Customer Web Service
- the Sony Life app
- the direct claims service
- the online copy of application details
- the document confirmation site
- the exchange-rate lookup system
At first the suspension was described as "emergency maintenance". Later that day Sony Life disclosed the breach and set up a temporary toll-free hotline (0120-833-344). It also reported the incident to Japan's Financial Services Agency.
The first notice covered only the Medicare Life records. Insurance Business reports that Sony Life has sold Medicare Life's medical insurance through its Lifeplanner sales channel since January 2023. The data sat on Sony Life's systems, not on those of the insurer that underwrites the policies. Medicare Life published its own notice the same day. It said customers who bought through other channels were not affected.
According to Japanese security firm Guardian, Medicare Life paused new My Page registrations on 29 October. On 2 November it resumed registrations for customers who did not buy through Sony Life. For policies sold by the Sony Life group, new registrations, adding contracts, cancellations and changes to payment method stayed suspended.
The 9 November notice is the second update. CyberSIXT reports that the ongoing investigation found about 2.9 million records from Sony Life's own book of policies, including policies that have already ended. In an analysis note on 28 October, threat intelligence writer Fabio Correia warned readers not to treat the 385,000 figure as affecting Sony Life's own customers. That was correct for the facts known at the time. The new notice shows the breach does reach Sony Life's own policies.
CyberSIXT reports that six online services were still suspended as of 9 November.
What Was Taken
The breach affects three groups of data.
Medicare Life records (about 385,000). These cover policyholders and insured people. The exposed fields are name, date of birth, sex, address, phone number, policy number and contract details. Insurance Business, セキュリティ対策Lab, derimeter, Guardian and 情報漏えい.jp all report the same figure and fields. Several of them note that this is a count of records, not people.
Sony Life's own policy records (about 2.9 million). CyberSIXT and BigGo report that these records include policy number, name, address and phone number. CyberSIXT says the company has stated the following are not included: health information, medical history, My Number national ID numbers, credit card details, bank account details and email addresses. Unlike the Medicare Life set, the reports do not list date of birth or contract details for these records.
Staff and agency data. CyberSIXT reports that the attackers also took:
- email addresses and agent numbers for about 780 people at sales agencies
- email addresses and employee numbers for about 12,500 Sony Life employees
BigGo confirms that employee email addresses and sales agency information were exposed but gives no counts.
Sony Life says it had found no misuse of customer information as of 9 November. It says it will contact affected customers and agents once it is ready. No regulator filing with independent figures has been published.
Why It Matters
Callers can sound genuine. No card or bank data was taken, so the risk of direct financial theft is lower. But the stolen data is very useful for impersonation. The German outlet derimeter points out that anyone who knows a person's identity and policy number can pose convincingly as an insurer's employee on the phone. Fabio Correia gives a concrete warning: a message that already knows your policy number and asks for your My Number is not from Sony Life. Both insurers have warned customers about emails, texts and calls asking for passwords or verification details.
The agent model spreads risk. Medicare Life's customers were exposed through a distributor's systems, not the underwriter's own. Insurers that use outside agents or partners share responsibility for data they do not directly control.
Staff data opens a second route in. About 12,500 employee email addresses and employee numbers, plus agency contact details, give attackers a ready list of targets. That makes convincing phishing against staff and agents, including messages that appear to come from inside the company, much easier. Defenders at Sony Life and its agencies should expect that follow-on activity.
Expect the count to grow. The disclosed count has grown about eightfold in two weeks. It is still counted in records, not people, and the investigation has not finished. Treat 3.2 million as the minimum so far, not the final number.
A separate Sony incident. Derimeter and Fabio Correia both note that another Sony company was hit around the same time. Correia names So-net and a figure of 2.58 million. Neither source shows any link between the two incidents, and Correia explicitly warns against combining the figures. Treat them as separate until shown otherwise.
The Attack Technique
Sony Life has not said how the attackers got in. Derimeter notes that the company has not disclosed:
- the route the attackers took or the weakness they used
- whether the attack was targeted
- how long they had access before it was found on 27 October
Guardian and 情報漏えい.jp both say Sony Life describes the cause as "under investigation".
What the reports do establish is narrower. The intrusion reached the internet-facing policyholder portal and connected back-end systems. Those systems held records for active and ended policies, Medicare Life policies sold through the agency, and staff and agency directory data. Data from that many sources being reachable suggests the compromised systems had broad access to customer and staff data stores. That is an inference from the disclosed data, not something the company has confirmed. No ransomware group or other actor has claimed the attack, and there are no public reports of the data being offered for sale.
What Organizations Should Do
- Limit what your customer portal can reach. Portals for viewing and changing contracts should not be able to query data for ended policies, partner products or staff directories. Segment the back-end services and give each one only the data it needs. Monitor large or unusual queries.
- Keep data held for each partner separate and mapped. Guardian's main lesson from this case is aimed at agents and subcontractors. Keep each partner's customer data separate, and be able to say quickly which fields, how many records and where they are stored. Agree in contracts who handles first alerts, public statements, notifying customers and reporting to regulators.
- Delete or archive data for ended policies. The 2.9 million records include ended policies. Apply retention limits and move closed-account data out of systems that face the internet.
- Prepare customers for impersonation calls. Tell customers exactly what your staff will never ask for, such as passwords, My Number or one-time codes. Give them a verified phone number to call back. Add identity checks on inbound calls for any request that changes payouts, beneficiaries or contact details.
- Treat leaked staff and agency data as a phishing warning. Turn on stronger email filtering for the affected staff and agents. Require phishing-resistant multi-factor authentication, and watch for messages that appear to come from inside the company and refer to the incident.
- Decide in advance when to shut a customer site down. Sony Life took its services offline within a day. Set clear thresholds for suspending customer-facing services, and have backup channels ready for claims and urgent changes before you need them.
Sources: Sony Life finds 2.9 million more policy records leaked in breach | Sony Life cyberattack exposes 385,000 Medicare Life records Insura... | Sony Life Insurance Data Breach Grows to Over 3.2 Million Cases Aft... | ソニー生命に不正アクセス、メディケア生命の約38.5万件の個人情報漏洩-証券番号・契約内容も対象、アプリなど6サービス停止セキュリティ... | Sony Life verliert 385.000 Kundendaten. Der Einstieg bleibt unbekan... | ソニー生命の不正アクセス｜約38.5万件の漏えいと他社の顧客情報を預かる企業の3つの対策 | The agency site had the policy Fabio Correia | ソニー生命保険株式会社（お客さまWEBサービスなど（ソニー生命が保険代理店として取り扱ったメディケア生命保険の契約情報））の個人情報漏...