Sony internet provider breach exposes 2.6 million customer records

Who is affected

Attackers broke into the database of So-net, a Japanese internet service provider owned by Sony Network Communications. The breach affected 1,869,771 current So-net members and 272,215 former members who left the service in March 2026 or later, totalling 2,141,986 people. An additional 443,495 records were taken from plala (S Course), another service, including 21,130 former members. In total, more than 2.6 million people had their data exposed. Customers who cancelled their subscriptions before March 2026 were not affected. The breach also impacted users of four So-net email services, with 54,401 email addresses and their passwords stolen. Only 16 bank account records were exposed, and these did not include PINs. No credit card information was leaked. Help Net Security↗ (opens in a new tab)

What was taken

For So-net and plala members, the leaked data included names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. The company stated that no account passwords were leaked for these membership records. However, for 54,401 So-net email accounts, both the email address and its password were exposed. The largest group affected used the free Mail Service (G), while the rest belonged to paid services such as A-Box, VAIO Mail and PostPet Mail. The attackers also accessed 16 bank account records (bank and branch names, account type, account number, account holder name) and data from seven password reset notices. No credit card data was included in the breach.

How the attack worked

Sony Network Communications said the breach was caused by "unauthorised access by a third party" to the member database. The attack took place on 19 October 2026 and was confirmed on 23 October. The company immediately stopped the affected server and blocked communications from the source of the attack. An investigation completed the next day identified the types and number of records leaked. The company has not yet said how the attackers gained access or whether any specific vulnerability was exploited. The investigation is ongoing.

The response

Sony Network Communications apologised to customers and reported the incident to Japan’s Personal Information Protection Commission. The company reset all affected email passwords on 27 October to prevent further misuse. Affected users must set new passwords through the So-net portal. Customers have been warned to watch for suspicious emails, texts or calls that could use the leaked information for phishing. Sony set up a dedicated phone line and FAQ page for affected users. The company said it is reviewing its security measures and information management systems. At the time of reporting, no secondary damage had been confirmed, but the company warned that phishing attempts could follow.

What you should do

Customers should be cautious with any unexpected messages, especially those asking for personal information or containing links and attachments. Do not respond to suspicious emails, texts or calls. If you use a So-net email service, reset your password and consider changing passwords for other accounts that used the same password. Monitor your accounts for unusual activity and contact the company if you have concerns.