Sony's So-net internet service hacked: 2.58 million member records leaked
Sony Network Communications says hackers broke into the member database of its Japanese internet provider So-net on 19 October, exposing names, birth dates and phone numbers in 2,585,481 records, plus passwords for 54,401 email accounts and 16 bank account records.
Sony Network Communications, the Sony group company that runs the Japanese internet service provider So-net, said on Tuesday, 27 October, that an outside attacker had broken into its member database and stolen personal data belonging to more than 2.5 million people. In total, 2,585,481 records were leaked, the company said in a notice on its website, in which it apologised to customers.
According to the company's timeline, the intrusion took place on Monday, 19 October, but was only spotted four days later, on 23 October. So-net then shut down the affected server and cut off the attacker's connection. On 24 October, its investigation confirmed that personal data had been taken and established how much.
Most of the records, 2,141,986, belong to So-net customers: 1,869,771 current members and 272,215 people who cancelled their accounts from March 2026 onwards. Another 443,495 records belong to users of plala (S course), an internet service that So-net runs on behalf of the mobile operator NTT Docomo for its Docomo Hikari fibre customers. Docomo said it was informed on 26 October. In both groups, the stolen data include names, phone numbers, email addresses, dates of birth, gender, user IDs and internet connection IDs. Account passwords and credit card details were not leaked, the company said.
Some passwords did get out, however. The attackers obtained the email addresses and their passwords for 54,401 mailboxes on four So-net email services, including VAIO-branded and PostPet-branded addresses. So-net reset those passwords on 27 October and is asking the affected users to set new ones. The breach also exposed 16 bank account records, with the bank, branch, account number and account holder's name, although the company says it does not hold PIN codes. Seven password-reset notices were also leaked.
Sony Network Communications said other services, including its NURO fibre broadband, were not affected. It has reported the incident to Japan's Personal Information Protection Commission and says the cause is still under investigation. As of 27 October, it had found no misuse of the stolen data, but it warned customers that they may receive scam emails, text messages or calls, and urged them not to reply, open links or download attachments. The company is contacting affected customers individually and has set up a dedicated helpline.