Sony So-net breach exposes 2.58M customer records

So-net discloses a breach of 2.58 million customer records

Sony Network Communications has disclosed that an outside attacker got into So-net's member database, exposing 2,585,481 customer records from So-net and plala (S Course). So-net is a Japanese internet provider, and Sony Network Communications is the Sony Group company that runs it.

NTT Docomo sells plala (S Course) as a provider plan with Docomo Hikari, its fiber line. Docomo contracts the plan's operation out to Sony Network Communications. Sony Network Communications announced the breach on October 27 and updated its notice on October 29.

The total is a count of records rather than people, so the same person may be counted more than once. The table below splits it by service and by current or former membership.

Leaked member records by service (from So-net's notice)

Service	Current members	Left in March 2026 or later	Total
So-net	1,869,771	272,215	2,141,986
plala (S Course)	422,365	21,130	443,495

Each affected customer will get an individual apology from the company. For other breaches Japanese companies have disclosed, see Japan data breach list: cases by date and cause.

Attackers got in on October 19, found on October 23

The attacker accessed the database on October 19, 2026, and Sony Network Communications discovered the access four days later, on October 23. It then shut down the affected server and blocked traffic from the source of the attack.

The next day, October 24, the investigation confirmed that personal data had leaked and identified which fields and how many records were involved. The company went public three days after that, on October 27.

Current members and those who left in March or later

Both current members and people who canceled in March 2026 or later are affected. The company still held former members' data because it keeps records for a period after cancellation to bill the last month of service and handle inquiries.

Anyone who canceled by the end of February 2026 is not affected. Sony Network Communications also says it has found no leak from NURO or its other services.

Names, birth dates and five other data fields were exposed

The same seven fields were exposed for So-net and plala (S Course) members: name, phone number, email address, user ID, date of birth, gender and internet connection ID. The user ID is the one you enter to sign in to My Page, So-net's account site. The connection ID is a separate credential that your router or PC uses to get online.

A handful of So-net records contained more sensitive data. In 16 cases, bank details were exposed: the bank and branch, plus the account type, number and holder's name.

Another seven records were notice letters So-net issues to members who need to reset a password. None of the bank or notice-letter records belonged to plala (S Course) customers.

54,401 email addresses also had their passwords exposed

For users of four So-net mail services, both the email address and the mailbox password were exposed. With that pair, someone else could sign in to the mailbox through a mail app or So-net Webmail.

Email addresses whose password leaked (from So-net's notice)

Mail service	Free or paid	Addresses
Mail Service (G)	Free	24,655
A-Box additional mailbox	Paid	17,672
So-net VAIO Mail	Paid	7,005
PostPet Mail Account Service	Paid	5,069
Total		54,401

The four services do not include the free basic mailbox that every So-net account gets on the so-net.ne.jp domain. So-net says it has found no sign that those passwords leaked.

Login passwords and credit card data were not exposed

Apart from the seven notice-letter cases, the password for signing in to My Page was not exposed. Credit card data was not affected, since Sony Network Communications says it does not store card numbers. It does not hold bank PINs either.

Sony reset email passwords, but the cause is unknown

Sony Network Communications began force-resetting the passwords of all 54,401 affected email addresses at around 10 a.m. on October 27. Left in place, the leaked passwords would have let a third party read those inboxes and send mail from those addresses.

The company has reported the breach to Japan's Personal Information Protection Commission. It has not said how the attacker got in, and it has named no flaw, malware or suspect. Its investigation into the cause and full scope is still underway.

What Sony Network Communications has done so far

Step	When
Took the server offline and blocked the attacker's traffic	October 23
Reset the passwords of the 54,401 email addresses	October 27, from about 10 a.m.
Reported to the Personal Information Protection Commission	By October 27

No new leak has been found since the server went offline. Once the cause is clear, the company plans to review its security measures and the way it manages customer data.

Docomo's plala (S Course) data leaked through a contractor

NTT Docomo was notified by Sony Network Communications on October 26 and posted its own notice for plala (S Course) customers the next day. Docomo gives the same count, 443,495 records, covering current users and customers who canceled within the past six months.

Docomo says customers on other plans, including plala on Docomo Hikari outside the S Course, are not affected. In Docomo's case, the data leaked from a contractor's database, not from its own systems.

Watch for emails, texts and calls claiming to be So-net

Current and former So-net and plala (S Course) members should be wary of any unexpected email, text or call about this breach. With leaked names, phone numbers and email addresses, scammers can make a fake message look like it came from So-net. So-net asks members not to reply to such messages or open their links or attachments.

As of October 29, So-net says it has found no secondary harm from the breach. To check anything about your account, open So-net's site from a bookmark or by typing the address, not from a link in a message.

Users of the four mail services must reset passwords

Users of Mail Service (G), A-Box, So-net VAIO Mail and PostPet Mail can no longer use their old password. Set a new one on My Page, where you sign in with your user ID and login password. If you read mail in an app such as Outlook, update the saved password there too.

A new password can take anywhere from a few minutes to about 30 minutes to start working. If you used the old password on other sites, change it there too. A long, random password for each site keeps one leak from unlocking your other accounts.

Questions go to So-net's hotline at 0120-36-8887

So-net's dedicated hotline, 0120-36-8887, takes calls on weekdays and Saturdays from 10:00 to 18:00. It is also open on Sunday, November 1, and on the November 3 holiday. Docomo Hikari customers on plala (S Course) should call Docomo at 0120-035-700, which is open from 10:00 to 19:00 every day.

Both numbers are toll-free within Japan. So-net is contacting the members behind the 16 bank-detail records and the seven notice-letter cases individually, through My Page or by email.

What companies and employees should take from this breach

This breach points to two habits that limit the damage. Companies need to know which outside firms hold their customers' data, and employees should not trust a message just because it refers to a real leak.

Check how your vendors protect customer data

Docomo's customer data leaked from a database that another company ran on its behalf. Japan's Information-technology Promotion Agency (IPA) puts attacks on supply chains and contractors second on its 2026 list of the top ten threats to organizations. A company that keeps a list of which contractors hold which customer data can tell, on the day a contractor reports a breach, which of its customers are affected.

Don't click links in breach-themed emails

Phishing emails often use phrases like "data leak" or "unauthorized access detected" to push you into signing in. In phishing, a message poses as a real company to lure you to a fake site where you type in your details. Japan's National Police Agency says this kind of urgent wording shows up in many fake emails, and it advises reaching sites from a saved bookmark or the official app.