Sony Network Communications, the Sony Group company behind the Japanese internet provider So-net, says an intruder got into its member database and walked away with more than 2.5 million customer records (2,585,481 in total). The breach also reaches customers of NTT Docomo's fiber service, because Sony runs part of that service's back end, and tens of thousands of email accounts had their passwords exposed.
What happened
According to the company's official notice, an outside party accessed the So-net member database on October 19, 2026. Sony Network Communications only spotted the activity on October 23. Once it did, it shut down the affected servers and cut off traffic from the source of the intrusion. By October 24, its investigation had confirmed that personal information had been taken and how many records were involved. The company went public on October 27.
How the attacker got in is still unknown. Sony describes the cause only as unauthorized access by a third party and says the investigation is ongoing. It has reported the incident to Japan's Personal Information Protection Commission.
Who is affected
The notice breaks the exposed data into several groups:
- So-net members: 2,141,986 records, covering 1,869,771 current members and 272,215 people who cancelled in March 2026 or later.
- plala (S Course) members: 443,495 records, covering 422,365 current and 21,130 former members. This is the service Sony operates on behalf of NTT Docomo for its Docomo Hikari fiber customers, which is why Docomo has sent its own warning.
- Email accounts: 54,401 email addresses on several Sony-run mail services, including addresses on gyao.ne.jp, gate01.com, so-net.ne.jp, vaio.ne.jp and PostPet domains, were exposed together with their mailbox passwords.
- Bank details: bank account information for 16 So-net customers.
- Password reset letters: data from 7 notices issued to reset passwords.
For the member records, the stolen fields are full names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony says member login passwords were not exposed, no credit card data was involved, and people who left before the end of February 2026 are not affected. It has not found any leak from its other services, including the NURO fiber brand.
Why it matters
Even without card numbers, a set of names, birth dates, phone numbers and email addresses tied to a known ISP account is ideal material for convincing scams. Docomo has already warned its customers about phishing emails and fake websites posing as its d POINT Club loyalty program and a Universal Studios Japan prize campaign, which tell people they have won tickets and ask for personal details.
The incident lands during a rough stretch for Japanese companies. In just the past few weeks, hosting giant GMO Internet has been dealing with an extortion attack on its Onamae.com Desktop Cloud servers, and the Japanese government has held urgent meetings about the wave of attacks on major providers.
As of October 27, neither Sony nor Docomo said it had seen the stolen data being misused.
What customers should do
- Reset affected email passwords. Sony reset the exposed mailbox passwords itself on October 27. If you use one of the listed mail services, set a new password through the So-net My Page.
- Change reused passwords. If you used the same password for your So-net email anywhere else, change it on those sites too and turn on two-factor authentication where you can.
- Treat unexpected messages with suspicion. Sony advises customers not to respond to suspicious emails, texts or calls, not to click links in them and not to open attachments. Be especially wary of anything that mentions your So-net, plala or Docomo account, prizes, or points.
- Watch your bank account. The 16 customers whose bank details were exposed are being contacted individually. Anyone affected should keep an eye out for unusual debits.
- Use official channels. Sony has published a FAQ page and set up a dedicated phone line for questions. Look these up from So-net's own website rather than following links in an email.
0 Comments