Sony So-net Data Breach: 2.58 Million Member Records and 54,401 Mail Passwords Exposed, and the Vendor Checks Businesses Should Run
Sony Network Communications says an attacker reached its So-net member database and took data on 2,585,481 current and former customers, plus 54,401 mail passwords. Here is what is confirmed, what is not known, and what to check.
On this page 8 sections
Sony Network Communications, the Sony Group company that runs the Japanese internet provider So-net, says an attacker got into its member database on October 19, 2026 and took personal data on 2,585,481 current and former customers. The headline number is not the main lesson for businesses. The bigger points are that 54,401 email passwords leaked along with their addresses, that data on people who had already cancelled was still on the server, and that NTT Docomo's customers were exposed because Sony ran their service under contract.
What happened in the Sony So-net data breach
This timeline comes from Sony's official notice, published Tuesday, October 27, 2026 and updated October 29:
- Monday, October 19: an outside party accessed the So-net member database without authorization.
- Friday, October 23: Sony confirmed the access, shut down the affected server and blocked the attacker's connections.
- Saturday, October 24: the investigation confirmed that personal data had leaked and identified which items and how many records.
- Tuesday, October 27: the public notice went out. A forced reset of the affected mail passwords began at about 10:00 Japan time and rolled out in stages.
- Thursday, October 29: letters were mailed to the customers whose bank details or password reset documents were involved.
Four days passed between the break-in and its discovery. Docomo's own notice says Sony told Docomo on October 26.
What data was exposed in the So-net breach
| Group | Records | What leaked |
|---|---|---|
| So-net members | 2,141,986 (1,869,771 current, 272,215 who left in March 2026 or later) | Name, phone number, email address, user ID, date of birth, gender, internet connection ID |
| plala (S Course) members, a Docomo Hikari service | 443,495 (422,365 current, 21,130 former) | The same items |
| Mail accounts on four services | 54,401 | Email address and mail password |
| Bank account records | 16 | Bank name and code, branch name and code, account type, account number, account holder name |
| Password reset notification documents | 7 | Documents issued for password resets; Sony has reset those passwords |
The 54,401 mail accounts break down like this:
- Mail Service (G) (gyao.ne.jp, gate01.com, pbc.ne.jp and highway.ne.jp addresses), a free service: 24,655
- A-Box extra mailbox, paid: 17,672
- So-net VAIO Mail, paid: 7,005
- PostPet Mail Account Service, paid: 5,069
Sony says these were not leaked: My Page login passwords (apart from the 7 reset documents), the password for the basic so-net.ne.jp mailbox that comes free with membership, and credit card data, which Sony says it does not hold. It also says it found no leak affecting NURO or its other services. Docomo says its plala (S Course) customers' records did not include passwords, card data or bank account details.
What is confirmed and what is not known
Confirmed by Sony and Docomo: the dates, record counts and data items above. Sony has reported the incident to Japan's Personal Information Protection Commission and will contact affected customers one by one. As of October 29, Sony had not confirmed any secondary damage, meaning it had not seen the data being misused.
Not known yet:
- How the attacker got in. Sony gives the cause as unauthorized third-party access and says the investigation is still going.
- Who did it. Sony and Docomo name no group.
- Whether the data has been sold or published. Neither company says.
- How the mail passwords were stored. Sony's Q&A says it reset them because the leaked addresses and passwords could let outsiders read and send mail. That means they were usable, but the notice does not say whether they were encrypted or stored in plain text.
Who is affected by the So-net breach
The people affected are So-net members in Japan, including those who left in March 2026 or later, and Docomo Hikari plala (S Course) customers. According to Docomo, that covers current plala (S Course) customers and anyone who cancelled within the past six months. Docomo says its other plala services were not affected, and Sony says people who left So-net by the end of February 2026 were not included.
For a company outside Japan, the direct risk is limited to staff, offices or partners in Japan who use these services. The lessons apply to any business that hands customer data to a provider.
Why the So-net breach matters for a company network
Your customers' data lives at your contractors. Docomo's customers were exposed through a server Sony ran for Docomo. Your customers could be exposed the same way through your hosting company, CRM, billing platform or email provider. Your customers will see your name on the breach notice, not the contractor's.
Old data is still data. 272,215 former So-net members and 21,130 former plala customers were exposed. Sony says it keeps former members' information for a while after they cancel so it can bill the final month and answer questions. That is a normal reason, but every month you keep the data is another month it can be stolen.
A mailbox password opens more than the mailbox. If someone can read and send mail as one of your staff, they can reset passwords for other accounts, send fake invoices and reply inside real customer conversations. When staff use a personal ISP mailbox for work, the business has no control over how that password is protected.
Detection time matters. Four days went by before Sony noticed. Most businesses find out much later than that, if they find out at all.
What to do this week
| Check | Who | How |
|---|---|---|
| Staff or offices in Japan with So-net or plala (S Course) accounts | Anyone affected | Watch for Sony's individual notice, reset the mail password through So-net My Page, then update it in Outlook or other mail apps |
| Reused passwords | IT | If a So-net mail password was used anywhere else, change it there too |
| Phishing warning | All staff | Do not reply to unexpected email, SMS or calls; do not open links or attachments; check the provider's number on its official site before calling |
| Vendor data map | Owner and IT | List every provider holding customer data: what data, where it is stored, and how many hours the contract gives them to tell you about a breach |
| Data retention | Owner | Set a deletion date for former customer records and check that it actually runs |
| Business email | IT | Move work mail off ISP or personal mailboxes onto company-domain accounts with multi-factor authentication |
| Detection | IT or provider | Turn on alerts for large database exports and unusual outbound traffic, and have someone review them every week |
The official support lines are Japanese toll-free numbers: So-net at 0120-36-8887 (weekdays and Saturdays, 10:00 to 18:00) and Docomo's plala (S Course) line at 0120-035-700 (10:00 to 19:00, including weekends and holidays). Sony's Q&A asks people to double-check the number before dialing, since scam emails pretending to be So-net have been reported.
If your servers or customer databases are self-hosted, our self-hosting infrastructure page explains how we set up logging and alerts.
Sony data breach questions people are asking
Was Sony hacked in 2026?
Yes. Sony Network Communications, the Sony Group subsidiary that runs the So-net internet service in Japan, says its So-net member database was accessed without authorization on October 19, 2026. Its notice does not mention any other Sony business.
How many people were affected by the So-net breach?
Sony lists 2,585,481 member records: 2,141,986 from So-net and 443,495 from plala (S Course). It lists 54,401 mail accounts, 16 bank account records and 7 password reset documents separately.
Were passwords leaked in the So-net breach?
Mail passwords leaked for 54,401 addresses on four services: the free Mail Service (G) and three paid services (A-Box, So-net VAIO Mail and PostPet Mail). Sony says My Page login passwords and basic mailbox passwords were not leaked, apart from 7 reset documents.
Were credit cards or bank details exposed?
No card data was exposed, because Sony says it does not hold any. Bank account details for 16 So-net customers were exposed, without PINs, which Sony says it does not store. Docomo says no bank details were included for plala customers.
Has the stolen So-net data been misused?
As of October 29, 2026, Sony said it had not confirmed any secondary damage. That could change, so expect phishing that uses real names and phone numbers.
What should So-net customers do now?
Reset any affected mail password through My Page, change it anywhere else it was reused, and do not respond to unexpected messages or calls, even ones that know your details.
The bigger lesson
A breach at your provider still reaches your customers, and data you no longer need can still leak. Know which providers hold your data, how fast they have to tell you about a breach, when old records get deleted, and who would notice a database export at 3 a.m.
See how we lock down systems at security hardening, or request a quote for a review of your vendors and data.
Get security alerts by email, along with our free checklist, at security alerts.
Sources: So-net breach notice, Sony Network Communications; So-net breach questions and answers; NTT Docomo plala (S Course) notice.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Moldova Cyberattack: State Actor Suspected After Citizen Data Was Taken From Government Systems, What Is Confirmed and What to Check
Moldova says hackers accessed the personal data of about 450,000 citizens through government digital services....
Park Dental Data Breach Settlement: Up to $2,500 for Patients, a December 28 Claim Deadline, and Why the Case Is Still Not Over
Park Dental patients have until December 28, 2026 to claim up to $2,500 or $60, plus credit monitoring, over a...
Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check
Rosstat says it is still restoring systems after cyberattacks from October 29 to November 1, 2026. Hackers cla...
