Sony Network Communications, the Sony Group subsidiary that runs the So-net internet service in Japan, has confirmed that an attacker accessed its So-net member database and took personal information tied to 2,585,481 customer records. The breach also exposed 54,401 email addresses together with their email passwords, and bank account details for 16 customers.
The company disclosed the incident in a notice published on October 27, 2026. NTT Docomo, which contracts Sony Network Communications to run part of its Docomo Hikari fiber service, issued its own customer notice the same day because 443,495 of the affected records belong to its customers.
How the So-net breach unfolded
According to Sony Network Communications, an outside party gained unauthorized access to the So-net member database on Monday, October 19. The company did not confirm the access until Friday, October 23, four days later. It says it then shut down the affected server and blocked communication from the source of the attack.
By October 24, the investigation had confirmed that personal information was leaked and identified which data types and how many records were involved. The company says the cause is still under investigation. It has reported the incident to Japan’s Personal Information Protection Commission.
Sony Network Communications has not said who was behind the attack or how the attacker got in, and it has not described the incident as ransomware.
What data was exposed
The notice breaks the exposed data into five groups:
- So-net members: 2,141,986 records, covering 1,869,771 current members and 272,215 former members who left in or after March 2026.
- plala (S Course) members: 443,495 records, covering 422,365 current and 21,130 former customers of the Docomo Hikari plala (S Course) service.
- Email accounts with passwords: 54,401 email addresses and their passwords across 4 So-net mail services, including a free mail service on legacy domains, the paid A-Box extra mailbox, So-net VAIO Mail and PostPet mail accounts.
- Bank account details: 16 records containing the bank name, branch, account type, account number and account holder name.
- Password reset notices: 7 records of notices issued for password resets.
For both the So-net and plala (S Course) groups, the exposed fields are full names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. The company says login passwords for these member accounts were not exposed.
Sony Network Communications says no credit card information was involved in any of the 5 groups. It also says it has found no leak from its other services, including the NURO fiber service. Former members who canceled by the end of February 2026 are not affected.
Password resets and Docomo customers
To limit further damage, the company reset the passwords for all 54,401 affected email addresses on October 27. Customers in that group must set a new email password through the So-net My Page portal. The 7 accounts tied to leaked reset notices also had their passwords reset, and the 16 customers whose bank details were exposed will be contacted individually.
NTT Docomo says Sony Network Communications told it about the breach on October 26. Its notice says the affected plala (S Course) data includes so-net.ne.jp email addresses and any registered contact email address, but no passwords, credit card numbers or bank account details. Docomo says other plala services were not affected.
Phishing risk for affected customers
Both companies say they had not found any secondary damage or misuse of the data as of October 27. They warn that criminals may use the stolen details to send convincing scam emails, text messages or phone calls. Customers are advised not to respond to unexpected messages, not to click links in them and not to open attachments.
The stolen mix of names, phone numbers, birth dates and email addresses is well suited to targeted phishing. Docomo separately warned customers on October 27 about fake emails posing as its d POINT Club and offering Universal Studios Japan tickets, though it did not link those emails to the So-net breach.
So-net customers who reused their So-net email password on other sites should change it on those sites as well. Sony Network Communications has set up a question and answer page and a dedicated phone line for affected customers.
Another major breach in Japan
The So-net incident adds to a string of large cyber incidents at Japanese companies this month. BreachNews has covered the GMO Internet cloud desktop breach, the Capcom ID breach affecting 11.7 million account records, the IDC Frontier ransomware attack and the Lawson data breach exposing 2.15 million customer records. Telecom provider KDDI has also reported a third-party software breach that may have exposed 14.2 million email accounts.
BreachNews will update this article if Sony Network Communications shares the cause of the breach or new details about who was behind it.
