Sony Network Communications breach exposes 2.58M So-net and plala customer records and 54,401 email credentials in Japan

Linha do tempo

1. securityweek.com ↗ · pub. 29/10/2026 08:00 · coletado 29/10 09:00

   Hackers steal 2.6 million subscriber records from Sony's Japanese ISP So-net and Plala

   ler a análise desta fonte ocultar

   Sony Network Communications announced on October 27 that attackers stole personal data on nearly 2.6 million current and former So-net and Plala internet subscribers in Japan. The intruders broke into the So-net member database on October 19. The company detected the intrusion on October 23, took the targeted server offline and blocked the attackers' traffic. Investigators confirmed the data theft and its scope the next day. The initial access method has not been disclosed, and the company lists the cause only as unauthorized access by a third party while the investigation continues.

   Technical Details

   • Exposed fields: names, dates of birth, gender, phone numbers, email addresses, user IDs and internet connection IDs.
   • Of the roughly 2.6 million records, 2.14 million belong to So-net subscribers and 443,000 to Plala (S Course) subscribers. About 293,000 relate to people who left the services in March 2026 or later, as their data is retained to handle final billing and support.
   • Attackers also obtained about 54,000 email addresses with their passwords for four mail services: Mail Service (G), A-Box, So-net VAIO Mail and PostPet. No password leak has been identified for the free basic mailbox bundled with a subscription.
   • With the leaked credentials, a third party could view, send and receive email through email software and So-net Webmail.
   • 16 records with bank account details were exposed (bank, branch, account type, number and holder name). So-net does not hold the PINs.
   • Credit card data is not involved because So-net does not store it. NURO and the company's other offerings do not appear to be affected.
   • The incident has been reported to Japan's Personal Information Protection Commission.

   Remediation

   • On October 27, So-net began resetting passwords for the affected email addresses, forcing users to set new ones before they can resume using the services.
   • Affected subscribers should expect phishing and spam that abuse the exposed contact details, and should change passwords reused on other services.
2. bleepingcomputer.com ↗ · pub. 28/10/2026 13:45 · coletado 28/10 14:00

   Sony Network Communications breach exposes 2.5 million So-net and plala customer records in Japan

   ler a análise desta fonte ocultar

   Sony Network Communications, a Sony Group subsidiary that operates the ISP So-net in Japan, confirmed that an unauthorized party accessed its So-net member database on October 19. The company detected the intrusion four days later, shut down the compromised servers and blocked external communication. In total, 2,585,481 customer records were exposed, split between 2,141,986 So-net entries and 443,495 plala (S Course) records. The plala records belong to NTT Docomo's Docomo Hikari customers, since Sony Network Communications provides that service under contract. A further 54,401 email addresses from several email services were exposed along with account passwords. Neither company had confirmed misuse of the data in the wild as of October 27.

   Technical Details

   • Breach date: October 19, detected October 23.
   • Exposed: personal information of current and former customers, plus 54,401 email addresses with account passwords. The article does not list the individual personal data fields.
   • Not exposed: banking, payment card or other account details.
   • NTT Docomo says the incident affects all current Hikari clients and those who canceled within the preceding six months.
   • Docomo warned of phishing emails and fake websites impersonating d POINT Club and a Universal Studios Japan (USJ) campaign, falsely claiming recipients had won tickets and prompting them to enter personal information.
   • The initial access vector and the attacker are not stated.
   • The incident was reported to Japan's Personal Information Protection Commission, and the cause and scope are still under investigation.
   • The article places this in a wave of Japanese incidents: GMO Internet Group / Onamae Desktop Cloud malware attack, a KDDI breach affecting 12 million customers, ransomware against IDC Frontier, and the early-2025 NTT breach affecting 18,000 corporate customers. The Japanese government held urgent meetings on Monday to plan its response.

   Remediation

   • Sony advises affected users to change their passwords.
   • Customers should treat unsolicited messages about d POINT Club or USJ prizes as phishing and avoid entering personal information on unverified sites.
3. gbhackers.com ↗ · pub. 28/10/2026 08:56 · coletado 28/10 10:00 primeiro registro

   Sony Network Communications breach exposes 2.58M So-net and Plala customer records and 54,401 email credentials

   ler a análise desta fonte ocultar

   Sony Network Communications disclosed on October 27, 2026 a data breach affecting So-net and Plala (S Course) internet services, exposing 2,585,481 customer records (2,141,986 from So-net and 443,495 from Plala). Passwords for 54,401 email addresses were compromised, but primary membership passwords and credit card data were reportedly not affected. Unauthorized access occurred on October 19 and was detected on October 23. Sony has not identified the exploited vulnerability, malware, intrusion technique or responsible threat actor, and the investigation is ongoing. No secondary harm had been confirmed as of October 27.

   Technical Details

   • Timeline: unauthorized access on Oct 19; detection and server shutdown on Oct 23, with communications from the unauthorized source blocked; leakage of personal data confirmed on Oct 24; the Personal Information Protection Commission (Japan) was notified and a customer advisory published on Oct 27.
   • Exposed data: names, telephone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.
   • Email credentials affected, by service: Mail Service (G) 24,655; A-Box additional mailboxes 17,672; So-net VAIO Mail 7,005; PostPet Mail 5,069.
   • Also exposed: 16 bank account records (institution, branch, account type, number and holder name; Sony does not retain PINs) and 7 password reset notification records.
   • The total includes 272,215 former So-net and 21,130 former Plala members who canceled in March 2026 or later.
   • It is unclear how the passwords were stored or whether individual mailboxes were accessed. No leakage was confirmed for other services such as NURO.

   Remediation

   • Sony reset passwords for the affected email addresses on October 27; affected users must set new passwords through the So-net My Page portal.
   • Customers should avoid responding to suspicious emails, SMS or calls, and should not click embedded links or open attachments, since the exposed data supports targeted impersonation and phishing.
   • Sony committed to reviewing its security controls and information management practices.