Sony's ISP arm confirms breach of 2.5 million customer records in Japan

Sony Network Communications, the internet provider arm of Sony Group, has confirmed that an unauthorized party reached its So-net member database on Monday, October 19, and took personal data on roughly 2.5 million current and former customers.¹

The company spotted the intrusion four days later, on October 23, shut down the affected server and blocked traffic from the source of the access.²¹ By the next day it had confirmed that data left the building. The cause is still under investigation, and the company has not said who was behind it or how they got in.²

The totals vary by source. BleepingComputer puts the exposed count at 2,585,481 records, made up of 2,141,986 So-net entries and 443,495 plala (S Course) records.¹ Asahi Shimbun reports about 2.14 million So-net records and about 440,000 plala records, and says the former-member records cover people who left in or after March 2026.³

The data includes names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.¹ Sony says passwords were not part of the main leak, but a separate set of 54,401 email addresses from several mail services was exposed together with their account passwords.¹³ Credit card details have not been confirmed as exposed.³ Asahi adds that 16 records included bank names and account numbers, a detail the English-language reports do not carry.³

The plala (S Course) records matter for a second company. NTT Docomo contracts Sony Network Communications to run its Docomo Hikari internet service, and Docomo says all current Hikari clients, plus anyone who canceled in the previous six months, are affected.¹

What you should do

If you use a So-net mail address, change that password now; Sony has reset the exposed mail passwords and is asking users to set new ones.³ If you reuse that password anywhere else, change it there too. It costs a few minutes and closes the one door that is clearly open.

Watch for phishing. Docomo has already warned of fake emails and sites impersonating its d POINT Club and a Universal Studios Japan campaign, claiming recipients won tickets and asking for personal details.¹ A message that knows your name and phone number is not proof it is genuine. As of October 27, neither company had confirmed misuse of the stolen data.¹

Sony has reported the incident to Japan’s Personal Information Protection Commission.¹

The wider run of attacks

This is one of several recent hits on Japanese providers. GMO Internet is dealing with a breach tied to its Onamae Desktop Cloud service, where a suspected attacker has posted data that appears linked to the company and its customers, though GMO is still checking whether it is genuine.⁴ KDDI suffered a breach affecting 12 million customers, IDC Frontier was hit by ransomware, and NTT lost data on 18,000 corporate customers in early 2025.¹ The pace was enough that the Japanese government held urgent meetings on Monday to plan a response.¹

Seen it before: a database holds years of customer details, nobody looks at it closely, and then everyone is surprised it was worth taking.

Our read: Sony’s disclosure moved quickly by the standard of these things, but the open questions are the important ones: how the attacker got in, and whether the 16 bank-detail records are the whole story on financial data. Watch for the cause finding and any update from the Personal Information Protection Commission.

Footnotes

1. BleepingComputer, “Sony ISP subsidiary data breach exposes 2.5 million customer records”. Retrieved October 29, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

2. TechRadar, “Data breach at Sony ISP subsidiary exposes 2.5 million customer records as Japan hit with another major cyberattack”. Retrieved October 29, 2026. ↩ ↩²

3. Asahi Shimbun, “ソニーのネットサービスで259万件流出　不正アクセスで口座情報も”. Retrieved October 29, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

4. TechCrunch, “Japan internet giant GMO says hackers posted stolen customer data”. Retrieved October 29, 2026. ↩