Sony confirms 2.58 million record breach; 54,401 email passwords exposed
Attackers accessed Sony Network Communications' member database on October 19 and stole data on roughly 2.58 million So-net and plala internet customers, including passwords for 54,401 email accounts and 16 bank account records; NTT Docomo confirmed 443,495 affected customers. Sony detected the intrusion on October 23, took the targeted server offline, and began resetting impacted email passwords on October 27; the entry method remains under investigation. Affected customers should change passwords and monitor bank accounts.
What happened
Intruders entered Sony Network Communications' member database on October 19 and stole data on roughly 2.58 million So-net and plala internet customers. The intrusion was detected on October 23 and announced on October 27. The theft includes passwords for 54,401 email accounts, 16 bank account records, and customer details; NTT Docomo confirmed 443,495 affected customers.
Why it matters
According to So-net, anyone who obtained the data could view, send, and receive email from the compromised accounts. Names, dates of birth, phone numbers, and internet connection IDs were exposed, and roughly 293,000 records belong to former customers. No credit card data or bank PINs are involved, as the company says it does not store them.
What to do
Reset passwords for affected email accounts (So-net has forced resets since October 27) and monitor the bank accounts in the 16 exposed records. Check whether the company holds accounts or customers on So-net, plala, or Docomo Hikari 'plala (S Course)'. Sony reported the case to Japan's Personal Information Protection Commission.
For the technical team
- Affected
- Sony Network Communications: base de dados de membros dos serviços de internet So-net e plala, incluindo 443.495 clientes do Docomo Hikari 'plala (S Course)' da NTT Docomo · So-net and plala (S Course) internet services of Sony Network Communications, including 443,495 customers of NTT Docomo's Docomo Hikari 'plala (S Course)'. Roughly 2.14 million records belong to So-net subscribers and about 293,000 to former customers who left in March 2026 or later. NURO and other company offerings were not affected.
- Exploitation
- Breach confirmed by Sony Network Communications and NTT Docomo. So-net says a third party who obtained the data could view, send, and receive email from affected accounts via email software and So-net Webmail. No group or country attributed; no PoC.
- Fix
- No software fix. Company mitigation: targeted server taken offline, attacker traffic blocked, and, since October 27, forced password resets for impacted email accounts before reuse.
- Vector
- Unauthorized third-party access to the So-net member database on October 19, 2026. The entry method has not been disclosed; Sony Network Communications lists the cause as unauthorized access and is still investigating.
- More details
- Timeline: intrusion on October 19, detection by So-net on October 23, confirmation of theft and scope the next day, announcement on October 27. Reported to Japan's Personal Information Protection Commission. Passwords leaked from four mail services: Mail Service (G), A-Box, So-net VAIO Mail, and PostPet; no password leak identified for the free basic mailbox. The 16 bank records include bank, branch, account type, number, and holder name; no PINs and no cards. BleepingComputer reported roughly 2.5 million exposed records.
Timeline
New reporting details the exposure: 54,401 email account passwords and 16 bank account records on top of the previously known data.
BleepingComputer reports the breach as exposing about 2.5 million customer records at Sony's ISP subsidiary.
NTT Docomo confirms 443,495 Docomo Hikari 'plala (S Course)' customers were affected; the attacker accessed the So-net database on October 19, 2026.
Want the next updates in your inbox? Get the daily edition →
See all 5 updates
New details: the intrusion occurred on October 19 and was spotted by So-net four days later; leaked data includes names, birth dates and phone numbers, plus 16 bank account records and passwords for 54,401 email accounts.
First report: Sony Network Communications confirms hackers accessed its member database on October 19, affecting about 2.58 million customers.
Sources 5 sources
- @Pirat_Nation @Pirat_Nation
- @IntCyberDigest @IntCyberDigest
- @H4ckmanac @H4ckmanac
- @BleepinComputer @BleepinComputer
- Hackers Steal 2.6 Million Records From Sony's Japanese ISP So-net SecurityWeek
