Sony Network Communications Discloses Theft of 2.59 Million Customer Records and 54,401 Email Passwords

Sony Network Communications, the Sony Group unit behind So-net, disclosed on October 27 that an attacker had taken personal data belonging to 2,585,481 current and former customers from its member database. The affected group includes So-net users and customers of the plala S Course service that Sony provides for NTT Docomo's docomo hikari business. The disclosure put a precise number on an incident that had been unfolding for more than a week.

The stolen data is not one uniform trove. So-net said the fields include names, dates of birth, gender, phone numbers, email addresses, user IDs and the connection IDs customers use to reach the internet. Member account passwords were not included, and the company does not store credit card information. A separate cache did pair 54,401 email addresses with email passwords across four mail services. That distinction matters because mailbox credentials can give an intruder a working key to a communications channel.

The totals split into 2,141,986 So-net records and 443,495 plala S Course records. The So-net figure covers 1,869,771 current members and 272,215 people who cancelled in March 2026 or later. The plala figure covers 422,365 current members and 21,130 former members. Sony said former customers remain because their details are retained for final bills and support requests.

Unauthorized access to the member database occurred on October 19. So-net confirmed the access on October 23, stopped the affected server and blocked communications from the source. An investigation completed on October 24 established that personal information had leaked and determined the affected fields. The company published its notice and began resetting the compromised passwords on October 27, then reported the matter to Japan's Personal Information Protection Commission. No secondary harm had been confirmed.

Key Facts

SecurityWeek reported on October 29 that the stolen fields include names, dates of birth, gender, phone numbers, email addresses, user IDs and internet connection IDs. It reported that the intrusion was detected on October 23, the targeted server was taken offline and investigators confirmed the data theft the following day. The company has not disclosed how the attacker gained access; it said the cause is unauthorized access by a third party, and the matter remains under investigation.

Help Net Security reported on October 28 that the 54,401 affected email passwords were reset on October 27. The mail services involved are Mail Service (G) with 24,655 addresses, A-Box additional mailboxes with 17,672, So-net VAIO Mail with 7,005 and the PostPet Mail Account Service with 5,069. The outlet also reported that member passwords were not leaked.

So-net said on October 27 that the free Mail Service (G) accounts were the largest exposed group and that no password leak was confirmed for the free basic mailbox included with a subscription. The company said 16 bank account records were exposed, containing the financial institution name, bank number, branch name and number, deposit type, account number and account holder name, but that it does not hold account PINs. Seven password-reset notice records were also part of the leak.

NTT Docomo announced on October 27 that 443,495 of its docomo hikari customers using plala S Course were affected and that Sony Network Communications reported the incident to it on October 26. Docomo said the exposed fields include name, phone number, email address limited to so-net.ne.jp domains, a contact email address where registered, birth date, gender, So-net My Page user ID and internet connection ID. It said password, credit card and financial institution account information are not included for its customers, and that other plala services and plala Hikari Mate with FLET'S were not affected.

EmailExpert reported on October 28 that the affected email passwords were reset eight days after the intrusion and four days after detection. The outlet placed it in a wider pattern of Japanese email provider breaches: Ymirlink disclosed the theft of about nine million records earlier in October, a Blastmail breach at Rakus Light Cloud affected customer records and mailing lists, with 345 contracts later confirmed, and KDDI disclosed in June a breach of a shared email platform later tied to 12.23 million exposed email addresses, including 7.6 million passwords stored in plaintext. So-net has not said whether any stolen credentials were used.

Analysis

The response follows a standard playbook: contain the server, block the source, count the records, notify the regulator and force password resets. What this really means is that the critical weakness is not the absence of a playbook but the gap between detection and disclosure, and knowing what a stolen mailbox password has already unlocked. The intrusion occurred on October 19 and was detected on October 23; the public notice arrived on October 27. Customers had no notice to change credentials during that window.

The password distinction is central. Broadband account passwords were not exposed, a meaningful limit. But the mail credentials were enough for a third party to view, send and receive mail through email clients or So-net Webmail, according to the company's FAQ. A mailbox is often the recovery point for other accounts, so the risk does not stop at the So-net boundary. So-net reset the passwords but has not disclosed whether they were used, leaving potential harm as the measure.

Retention practices also enlarge the blast radius. About 272,215 former So-net members and 21,130 former plala customers are included because their data is kept for final bills and support. That is legitimate, but it means a breach can reach people who believe they have left the service. The 16 bank account records are a small number, yet they include account and branch details. So-net holds no PINs and stores no credit card data, but any banking data in a consumer ISP database is still a governance issue.

The bigger picture here is that Japan's consumer email and broadband market is accumulating a familiar set of failures. The Ymirlink, Rakus and KDDI incidents cited by EmailExpert involve separate systems, but point to the same pressure points: large stores of identity data, mail credentials that double as recovery keys, and remediation that depends on customers acting later. So-net adds a notable brand and a large record count, but its cause is still unknown. That should worry the sector most, because an unknown entry path cannot be closed with confidence.

Why It Matters

For the 2,585,481 people affected, the practical risk is not a single fraudulent charge. It is targeted phishing that uses real names, birth dates, phone numbers and email addresses to make messages look authentic. So-net warned that suspicious communications exploiting the leaked information may arrive and told customers not to reply, open links or open attachments. NTT Docomo issued a similar warning to its plala S Course customers and said it would contact affected customers individually. That shifts the burden to users to recognize well informed scams.

For Sony Network Communications, the incident is a test of how much trust the So-net and plala brands retain. The company has given a detailed accounting of the data categories, opened a dedicated call centre and reported the breach to the Personal Information Protection Commission. Those steps do not answer the two questions that matter: how the attacker got in, and whether the stolen mail credentials were used. The absence of confirmed secondary harm is a status report, not a conclusion.

EmailExpert noted that JPAAWG, Japan's anti-abuse working group, meets in Tokyo on November 5 and 6. A breach of this size, following other email provider incidents, gives the gathering a concrete agenda: credential storage, reset procedures, detection windows and the quality of customer notification. The breach also arrives alongside unconfirmed PlayStation Network reports that accounts were hijacked and unknown child accounts added to family groups. Sony Interactive Entertainment had not confirmed a vulnerability, so those reports are separate but add to scrutiny on Sony's consumer services.

Next Up

The next milestone is a forensic finding. So-net has said only that a third party gained access and the cause is under investigation. Investigators will need to establish the entry point, how long the attacker had access, whether the 54,401 mail credentials were used and whether the 16 bank account records or seven password-reset notices led to follow-on fraud. No secondary harm was confirmed as of October 27.

Regulatory and customer steps will run in parallel. The Personal Information Protection Commission has been notified, Docomo will contact its affected customers, and So-net is directing users to reset email passwords via So-net My Page. Coming weeks will show whether the reset closes the exposure or the breach produces secondary fraud the company has not seen.