What was exposed

Sony Network Communications, the Sony Group subsidiary that runs the So-net internet service in Japan, has confirmed that an attacker accessed its So-net member database, exposing 2,585,481 customer records. The total comprises 2,141,986 So-net records and 443,495 plala records. The company disclosed the incident in a notice published on 27 October 2026.

The 443,495 plala records belong to NTT Docomo’s Docomo Hikari customers; NTT Docomo issued its own customer notice the same day, because Sony Network Communications runs part of that service for it. Exposed membership information includes names, telephone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.

Passwords and bank details

Separately, 54,401 email addresses together with their email passwords were exposed across four services: Mail Service (G) 24,655, A-Box 17,672, So-net VAIO Mail 7,005 and PostPet Mail 5,069. Sony reset those passwords on 27 October 2026. Bank account details for 16 customers were also exposed. Sony said main membership-account passwords were not exposed and credit-card information was not exposed.

Former customers are affected too: 272,215 former So-net members and 21,130 former plala members who cancelled from March 2026 onwards are included, while those who cancelled by February 2026 were not affected, according to the official notice as reported.

Timeline and investigation

Unauthorised access occurred on Monday 19 October 2026. Sony confirmed the intrusion on Friday 23 October, four days later, stopped the affected servers and blocked communications from the source. Sony reported the incident to Japan’s Personal Information Protection Commission, has not said who was behind the attack or how the attacker got in, has not described it as ransomware, and said no secondary harm had been confirmed as of 27 October 2026. The cause remains under investigation.

Sources: BreachNews (official Sony notice) | CybersecurityNews