Sony Network Communications, the Sony Group subsidiary that runs the Japanese internet provider So-net, said on 27 October 2026 that an outside party had accessed its So-net member database without authorisation. The breach exposed personal data on current and former customers of two consumer broadband services, So-net and plala (S Course). The company's own notice puts the total at 2,141,986 So-net records plus 443,495 plala records, which is 2,585,481 in all. BigGo and Cyber Kendra report the same exact figure, and CyberInsider describes it as "more than 2.58 million", rounded to 2.6 million in its headline. These are the same number at different levels of rounding, not competing estimates. The company also confirmed that email addresses and their matching mailbox passwords leaked for 54,401 accounts on four legacy mail services, along with bank account details for 16 customers. It says no credit card data was involved. It has not said who was behind the intrusion or how they got in.
What Happened
So-net's Japanese-language notice gives this timeline:
- Monday 19 October: an outside party accessed the So-net member database.
- Friday 23 October: the company found the access. It shut down the affected server and blocked traffic from the source of the intrusion.
- Saturday 24 October: an investigation confirmed that personal data had leaked and established which fields were affected and how many records.
- Tuesday 27 October: public disclosure. The company says it will contact affected customers individually.
That means the attacker had about four days of undetected access before containment. Disclosure followed three days after the leak was confirmed. The company gives the cause only as "unauthorised access by a third party (under investigation)."
Cyber Kendra reports that the incident has been reported to Japan's Personal Information Protection Commission and that So-net's internet connectivity was not disrupted. BigGo also names the Commission in its coverage. The company says it has found no leak affecting NURO, its fibre brand, or any service other than those listed in its notice.
No threat actor has claimed the attack, and no leak-site listing or ransom demand has been reported publicly. Sony has a long breach history, including the 2011 PlayStation Network intrusion and the 2014 Sony Pictures attack that the US government attributed to North Korea. Nothing published so far links this incident to either one, and readers should not assume a connection.
What Was Taken
The company's notice splits the exposed data into five categories:
- So-net member records: 2,141,986. These cover 1,869,771 current members and 272,215 former members who cancelled in or after March 2026. The exposed fields are name, phone number, email address, user ID, date of birth, gender and internet connection ID. The company says no account passwords were in this dataset. People who left by the end of February 2026 are not affected.
- plala (S Course) member records: 443,495. These cover 422,365 current and 21,130 former members, with the same fields and the same March 2026 cutoff. Again, the company says no passwords leaked. Cyber Kendra describes plala (S Course) as an NTT Docomo fibre plan.
- Email addresses with their mailbox passwords: 54,401. These are spread across four So-net mail services:
- Mail Service (G) (gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp domains, free): 24,655
- A-Box additional mailboxes (so-net.ne.jp, paid): 17,672
- So-net VAIO Mail (vaio.ne.jp, paid): 7,005
- PostPet Mail Account Service (postpet subdomains of so-net.ne.jp, paid): 5,069
CyberInsider notes that these accounts belong to people already counted in the So-net totals, so they do not add to the number of affected customers. 4. Bank account details: 16 records. These include bank name, branch, account type, account number and account holder name. The company says it does not hold account PINs and that no plala customers are in this group. 5. Password-reset notification data: 7 records. The company says it has reset the passwords on these accounts.
Two items matter most. The first is the internet connection ID. Cyber Kendra describes it as the credential a home router presents to the ISP. The company says the matching connection passwords were not exposed. The second is the 54,401 mailbox passwords. The company has not said whether they were stored in plaintext, encrypted in a way that can be reversed, or hashed. Cyber Kendra calls them "working passwords" and reports that Sony reset them without warning on 27 October. The company's notice says it took steps on these passwords "to prevent further damage", but the published text available at the time of writing cuts off before giving the details.
Why It Matters
Credential exposure is the immediate threat. Mailbox passwords paired with addresses are directly usable, and many people reuse passwords across services. Expect credential-stuffing attempts against Japanese banks, e-commerce sites and other ISPs in the coming weeks. Email accounts are also where password-reset links arrive for other services.
Phishing risk is high. Names, birthdates, phone numbers, user IDs and confirmation that someone is a So-net or plala customer give attackers what they need to impersonate the ISP convincingly. Breach disclosures reliably bring a wave of fake "security notice" and "password reset" lures. Customers who are expecting a message from So-net are easier to fool.
Retained ex-customer data increased the damage. About 293,000 of the exposed records belong to people who had already cancelled. Keeping data on former customers can be justified for billing and legal reasons, but every month it is kept adds to the potential exposure.
Recoverable passwords point to a design problem. If the mailbox passwords could be read back after theft, that suggests they were stored in a reversible form. This is common in legacy mail systems that need plaintext for older login methods, but modern practice treats it as a known weakness. The company has not confirmed how they were stored.
The disclosure was relatively fast. Detection to public notice took four days. Sony itself was criticised for a six-day silence after the 2011 PlayStation Network breach, which exposed 77 million accounts, as Stratrix's retrospective recounts. By that measure, Sony Network Communications moved quickly once it detected the intrusion. The weak point was the four days it took to notice the attacker in the first place.
The Attack Technique
The entry method has not been disclosed. The company's only stated cause is unauthorised third-party access, still under investigation. No CVE, vulnerable product or attack chain has been named by the company, by Japan's Personal Information Protection Commission or by the trade press.
The published facts allow only limited conclusions:
- The attacker reached a central member database holding records from at least two brands (So-net and plala) and several linked mail services. That suggests either a shared back-end store or access to a system with wide read rights.
- Containment involved shutting down a server and blocking traffic from specific sources. That fits an attack coming in from outside the network, but it does not establish whether the attacker came through an exposed application, a stolen administrator credential or a third-party connection.
- The data was taken over a period of up to four days, so the database queries and data transfers should be visible in logs if those logs exist.
Past Sony incidents involved credential phishing (Sophos and Vox describe Apple ID lures used against Sony Pictures staff in 2014) and network intrusions. Those cases say nothing about how this attack happened. Defenders should treat the technique as unknown until the company publishes its findings.
What Organizations Should Do
- Stop storing reversible passwords. Find any system, especially legacy mail, RADIUS or PPPoE authentication, that keeps passwords in plaintext or reversibly encrypted form. Move it to salted, slow hashing, or put it behind a separate credential store so that a breach of the member database does not also hand over login secrets.
- Add monitoring for unusually large database reads. A four-day window to export 2.5 million rows is long. Alert on unusual volumes of queries or exports from customer databases, on service accounts reading tables they don't normally touch, and on large outbound transfers from database servers.
- Enforce retention limits on former customers. Remove or anonymise personal data on cancelled accounts once billing and legal retention requirements are met. This incident shows how much exposure several months of retained ex-customer data can add.
- Keep shared systems from exposing every brand at once. When one company runs several brands or partner services from a shared customer database, restrict access by brand and by field so that one compromise does not expose every customer group at once.
- Watch for credential stuffing and phishing aimed at Japanese users. Banks, payment providers and online retailers serving Japan should expect logins from the leaked so-net.ne.jp, vaio.ne.jp, gyao.ne.jp and related addresses. Apply extra checks to those logins, and warn customers about fake So-net "security notices."
- Tell affected users what to do. So-net and plala customers should change any password they reused from a So-net mail account, turn on multi-factor authentication wherever it is offered, and verify any message about this incident through the So-net My Page portal rather than through links in emails or texts.
Sources: Sony discloses data breach exposing 2.6 million customer records | So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ｜お知らせ｜So-net | Data on 2.58 Million So-net and plala Members Leaked ... | Sony Network Data Breach: 2.58 Million Customers' Data Exposed - Cy... | 2014 Sony Pictures hack | Indian Strategic Studies: A Breakdown and Analysis of the December,... | Sony Phishing Breach Lessons Sophos Phish Threat Vox | Sony Detected the 2011 PSN Breach Within Hours and Stayed Silent fo...