Sony Network Communications has confirmed a large data breach affecting its Japanese internet services So-net and plala, after an intruder gained unauthorised access to its member database. The company disclosed the incident on 27 October 2026, saying 2,585,481 customer records were exposed. The disclosure covers current members and former members who cancelled from March 2026 onwards, a detail that widens the affected group beyond people still paying for the services.

According to the company account reported across several outlets, the unauthorised access took place on 19 October. Sony Network Communications confirmed the intrusion on 23 October, shut down the affected servers and blocked further contact from the intruder, then confirmed that personal information had leaked on 24 October. The company has apologised to customers, reported the matter to Japan's Personal Information Protection Commission, and reset passwords for the affected email accounts on 27 October. The way the intruder first entered the system has not been disclosed, and the investigation is continuing.

What was exposed

The totals break down into 2,141,986 So-net records and 443,495 plala S Course records. Plala S Course is the service offered under Docomo Hikari, with operations handled by Sony Network Communications. The exposed member information includes names, telephone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Former members are included in both totals, including 272,215 former So-net members and 21,130 former plala members who cancelled in or after March 2026.

Two smaller findings make the incident more serious than a simple contact-details leak. Email addresses and passwords were exposed for 54,401 accounts across four legacy email services, and 16 bank account records containing institution names, branch details, account numbers and account holder names were also identified. By contrast, the company said passwords for the main member accounts were not leaked, no credit card information was exposed, bank PINs are not stored in its systems, and NURO customer data was unaffected. This is not a PlayStation Network breach.

What customers should watch for

The combination of names, phone numbers, email addresses and dates of birth is well suited to phishing messages and impersonation attempts, so affected customers should treat unexpected messages asking them to log in or share details with extra caution. Anyone who reused one of the affected email passwords elsewhere should change it on the other service as well, and the small group with exposed bank details should watch account statements closely. The company has advised customers not to click suspicious links while its investigation continues.