The Sony data breach has exposed 2,585,481 customer records linked to the Japanese internet services So-net and plala S Course. The incident also compromised passwords for 54,401 accounts across four legacy So-net email services.
What happened in the Sony data breach
Sony Network Communications, which operates the So-net internet service, disclosed the breach on 27 October 2026. The company said an unauthorised third party accessed the So-net member database on 19 October 2026 and removed customer information.
The exposed data comprised 2,141,986 So-net member records and 443,495 plala S Course records. The affected fields included names, telephone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.
The incident affected both current So-net customers and former customers who had cancelled their service from March 2026 onwards. The plala S Course records related to a service offered under Docomo Hikari, for which NTT Docomo outsources certain operations to Sony Network Communications.
Sony Network Communications said ordinary So-net member account passwords were not part of the main customer datasets. Credit card information was also excluded. However, separate credentials associated with four legacy email services were compromised, making reports that no passwords were exposed incomplete.
Sony data breach affects legacy email services
In addition to the main customer database, the attacker obtained 54,401 email addresses and corresponding passwords. These credentials were associated with older email products provided by So-net rather than the standard member accounts covered by the larger dataset.
The affected email services and account totals were:
- Mail Service (G): 24,655 accounts using gyao.ne.jp, gate01.com, pbc.ne.jp or highway.ne.jp domains.
- A-Box: 17,672 accounts using the so-net.ne.jp domain.
- So-net VAIO Mail: 7,005 accounts using the vaio.ne.jp domain.
- PostPet Mail Account Service: 5,069 accounts using postpet*.so-net.ne.jp addresses.
So-net forcibly initialised the passwords for all affected email accounts on 27 October 2026. Customers must set a new password through So-net My Page before they can continue using the affected mailbox.
The Sony data breach also exposed 16 bank account records and seven password-reset notification letters. The company has not provided further public detail about the contents of those records, but it confirmed that no credit card information was included in the stolen data.
Which plala customers are affected?
NTT Docomo issued a coordinated notice confirming that 443,495 plala S Course customers were within scope. Their exposed information included the same categories of personal and account data found in the So-net customer records.
Docomo said the plala S Course subset did not contain passwords or payment information. It also clarified that other specified services, including plala (Docomo Hikari) and plala Hikari Mate with FLET’S, were not affected.
So-net separately stated that no leak had been confirmed for NURO or for services outside those specifically listed in its disclosure. These exclusions are important because Sony Network Communications operates several connectivity and related products beyond the affected database.
Timeline of the Sony data breach
The confirmed timeline shows an eight-day period between the initial intrusion and public disclosure:
- 19 October 2026: An unauthorised third party accesses the So-net member database.
- 23 October 2026: So-net confirms the unauthorised access, stops the affected server and blocks communications from the identified source.
- 24 October 2026: The investigation confirms that data was leaked and establishes the affected data types and record totals.
- 27 October 2026: Sony Network Communications publicly discloses the incident, resets affected email passwords and establishes dedicated customer enquiry channels.
- 27 October 2026: NTT Docomo publishes its own notice for plala S Course customers and opens a separate enquiry line.
Sony Network Communications also reported the incident to Japan’s Personal Information Protection Commission. Its investigation and root cause analysis remained in progress when the breach was announced.
How the intrusion occurred and current status
The company has confirmed external unauthorised access and data exfiltration from the So-net member database. It has not disclosed the precise intrusion vector, such as whether the attacker exploited a software flaw, used stolen credentials or accessed the system through another connected service.
No threat actor had been identified publicly as of 27 October 2026. There was also no disclosed evidence linking the Sony data breach to a known ransomware group, data leak site or wider campaign.
So-net reported that it had not identified secondary harm resulting from the stolen information. However, the combination of contact details, dates of birth, account identifiers and internet connection IDs could support convincing impersonation or phishing attempts. The legacy email passwords present an additional account access risk, particularly if customers reused those passwords elsewhere.
No indicators of compromise had been published by So-net, NTT Docomo, JPCERT or Japan’s Personal Information Protection Commission at the time of reporting. Without technical indicators, affected users and organisations must rely on official notices, password resets and reviews of their own account activity.
Actions taken for affected customers
So-net blocked communications from the source of the unauthorised access and stopped the affected server after confirming the incident. Its most immediate customer protection measure was the forced password initialisation for the 54,401 affected legacy email accounts.
The company advised customers not to respond to suspicious messages, follow unexpected links or open unsolicited attachments. It established an incident FAQ and a dedicated hotline on 0120-36-8887. NTT Docomo opened a separate plala S Course hotline on 0120-035-700.
Customers of the affected email services should reset their passwords only through So-net My Page. They should also change matching passwords on unrelated accounts and review mailbox settings for unfamiliar forwarding rules, recovery details or sent messages.
Why the incident matters to UK organisations
Although the Sony data breach occurred in Japan, it illustrates how outsourced customer management and older ancillary services can widen an organisation’s exposure. NTT Docomo customers were affected because elements of the plala S Course operation were managed by Sony Network Communications.
UK organisations using externally managed email, connectivity or identity services should confirm which supplier holds each category of customer data. Reviews should specifically include legacy products, former customer records and credential stores that may sit outside the organisation’s main authentication platform.
Where a supplier reports a similar incident, organisations should establish which users and data fields are affected, verify that required resets have occurred and prepare for targeted phishing based on the exposed information. Those actions are directly relevant here because the stolen records combine personal details with service identifiers and, for some users, exposed email credentials.
Originally reported by Yahoo.
