Sony-owned ISP So-net discloses breach of about 2.6 million customer records

Sony Network Communications, the Sony Group company that runs Japanese internet service provider So-net, has disclosed a data breach affecting about 2.58 million customer records, according to Help Net Security. The company said a third party gained unauthorized access to its member database on October 19, 2026, exposing personal data of current and former So-net and plala customers as well as tens of thousands of email passwords.

What happened

According to Help Net Security, the attack on the member database took place on October 19. The company confirmed the unauthorized access on October 23, shut down the affected server and cut off the attacker's connection. By October 24, its investigation had determined that personal data had leaked and identified the data types and record counts. A notice to customers was published on October 27. The company attributes the breach to unauthorized access by a third party, says the investigation is ongoing and has reported the incident to Japan's Personal Information Protection Commission.

What data was exposed

The exposed records include 2,141,986 So-net records, covering 1,869,771 current members and 272,215 people who left in March 2026 or later, and 443,495 plala (S Course) records, including 21,130 former members, Help Net Security reported. The data includes names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.

In addition, 54,401 email accounts had both the address and password exposed, most of them on the free Mail Service (G). Sixteen records contained bank name, branch, account type, account number and account holder name; the company says it does not hold account PINs. Data from seven password-reset notices was also exposed. The company says no passwords were leaked in the membership records themselves and no credit card information was included. Customers who cancelled by the end of February 2026 are not affected, and the company says its NURO fiber service and other services show no leaks.

Who is affected

Current So-net members, recent former members and plala S Course customers are affected. Users of the exposed email services face the most immediate risk because their mailbox passwords were exposed. As of October 27, the company had confirmed no secondary damage.

What to do

The company reset the affected email passwords on October 27 and says users must set new ones through the official So-net My Page portal. It is contacting affected customers individually and has set up a dedicated phone line and FAQ page. Customers are advised not to respond to suspicious emails, text messages or calls, not to open links or attachments in such messages, and to change passwords only through the official portal. Anyone who reused a So-net email password on other services should change it there as well.