Sony Network Communications has confirmed a data breach that exposed 2,585,481 customer records, including personal information belonging to current and former users of its internet services in Japan. The company also disclosed that email passwords for 54,401 addresses were compromised, along with 16 bank account records and seven password-reset notification records.
The incident involved the So-net member database operated by Sony Network Communications, a subsidiary of Sony Group Corporation that provides internet connectivity and other technology services. According to the company’s official security incident notice, unauthorized access occurred on October 19. Sony confirmed the intrusion on October 23, shut down the affected server and blocked communications from the source of the attack. By October 24, its investigation had identified the exposed information and the number of affected records.
The total includes 2,141,986 So-net records and 443,495 records belonging to plala (S Course), a service associated with NTT Docomo’s Docomo Hikari internet offering. The So-net total consists of 1,869,771 current members and 272,215 former members who canceled their subscriptions from March 2026 onward. The plala figure includes 422,365 current members and 21,130 former members who canceled from the same period. Sony said records belonging to customers who left by the end of February 2026 were not affected.
The exposed membership information includes full names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony said the passwords associated with these main membership records were not exposed. However, the company separately confirmed that email addresses and their corresponding passwords had been compromised across four email services: Mail Service (G), A-Box, So-net VAIO Mail and PostPet Mail.
The affected email services account for 24,655, 17,672, 7,005 and 5,069 addresses, respectively, bringing the total to 54,401. Sony warned that someone possessing these email credentials could potentially read messages and send emails through a mail application or So-net’s webmail service. To limit further misuse, the company forcibly reset the affected email passwords starting at around 10 a.m. on October 27. Impacted users must set new passwords before they can resume using those email services.
The company’s disclosure also corrects an important detail about financial information. Although credit card information was not exposed, Sony confirmed that 16 bank account records were compromised. The leaked fields include the financial institution’s name and number, branch name and number, account type, account number and account holder’s name. Sony said it does not hold the associated bank account PINs and that the 16 records did not belong to plala (S Course) customers. The company also identified seven exposed records containing password-reset notification information and said the associated passwords had been reset. Customers affected by these additional exposures are to be contacted individually.
NTT Docomo has separately acknowledged that 443,495 records associated with its plala (S Course) customers were affected through its contracted service provider. The company said the affected group includes current customers and people who canceled within the preceding six months. Docomo reported that passwords and payment-related information were not included in the exposed plala records.
Docomo has also warned customers about phishing emails and fraudulent websites impersonating its d POINT Club service and a Universal Studios Japan campaign. The messages falsely claim that recipients have won tickets and direct them to websites requesting personal information. Docomo says it is not running the ticket campaign described in these messages and advises customers not to open suspicious links or submit information through unofficial websites.
As of October 27, Sony Network Communications and NTT Docomo had not confirmed any secondary damage arising from the breach. However, the exposed contact information could be used in targeted phishing attempts, fraudulent messages or calls. Sony has reported the incident to Japan’s Personal Information Protection Commission and said it is continuing to investigate the cause and scope of the intrusion. The company has also pledged to review its security measures and information-management practices.
Sony has published a dedicated incident FAQ explaining the affected email services, password resets and steps customers should take. Customers who use the affected mail services should create new passwords through official So-net channels, while anyone contacted about the incident should verify the message independently before clicking links, opening attachments or sharing personal information.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The breach adds to a series of cybersecurity incidents affecting Japanese technology and telecommunications companies. Recent cases have included attacks involving GMO Internet Group’s Onamae Desktop Cloud service, a data breach reported by telecommunications provider KDDI and a ransomware incident affecting IDC Frontier. The growing number of incidents has also prompted increased attention from Japan’s government to the security of the country’s digital infrastructure.
Sony Data Breach Exposes 2.58 Million Records, Including Bank Details and Email Passwords
