Hackers Got Into Sony's So-net Database Four Days Before Anyone Noticed and Took 2.6 Million Customer Records

Someone broke into the member database of So-net, the Japanese internet provider run by Sony Network Communications, on Oct. 19. The company did not confirm it until Oct. 23. By then about 2.58 million customer records were gone, along with tens of thousands of email passwords.

Sony disclosed the breach on Tuesday, saying it had confirmed an information leak caused by unauthorized access to the member database and apologizing for "the great inconvenience and concern." Once it spotted the intrusion, it says it stopped the affected server and cut off traffic from the source. An investigation completed the next day confirmed that personal data had leaked.

What leaked

The total is 2,585,481 records. Most belong to So-net: 1,869,771 current members and 272,215 people who left the service in March 2026 or later. Another 443,495 come from plala (S Course), including 21,130 former members. The records hold names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony says no passwords were included in those membership records, and customers who canceled by the end of February 2026 are not affected.

The worse news sits in a separate pile. For 54,401 addresses across four email services offered to So-net members, the attackers got both the address and its password. The largest group, 24,655, used the free Mail Service (G); the rest were on A-Box, So-net VAIO Mail and PostPet. Sony reset those passwords on Oct. 27 "to prevent the damage from spreading."

Sixteen bank account records also leaked, with bank, branch, account type, number and holder name. Sony says it does not hold account PINs, and no credit card data was taken. Its NURO fiber and other services showed no leaks. The cause is listed only as unauthorized access by a third party, and the case has gone to Japan's Personal Information Protection Commission.

Docomo customers are caught up too

The plala records connect to NTT Docomo, which contracts Sony Network Communications to run its Docomo Hikari service. Docomo told customers the incident affects all current Hikari clients and anyone who canceled within the previous six months, and warned about phishing emails and fake sites posing as its d POINT Club and a Universal Studios Japan promotion promising free tickets.

Sony says that, so far, it has found no secondary damage from the breach. It still expects suspicious messages exploiting the leaked data could arrive later, and it is contacting affected customers individually, with a dedicated phone line and FAQ.

Another hit in a long Japanese year

So-net joins a grim list. GMO Internet Group saw customer servers hit through its Onamae Desktop Cloud service, KDDI disclosed a breach affecting 12 million customers, and IDC Frontier was struck by ransomware. The pace got bad enough that the Japanese government held urgent meetings on Monday to plan a response, following the emergency in cyberspace it declared after attacks on more than 20 major companies, from Lawson to Times Car.

Sony has a second headache this week, though nothing ties it to So-net. PlayStation Network users have been reporting on X that their accounts were hijacked and unknown child accounts added to family groups, some saying it happened with two-factor authentication on. Sony Interactive Entertainment has not confirmed any vulnerability or commented.

Some offers on this page may be paid placements or contain affiliate links.