Sony-owned internet service provider So-net has confirmed a data breach affecting more than 2.58 million current and former customers. Attackers gained unauthorized access to the company’s member database on October 19, stealing a large volume of personal information. So-net is a Japanese internet service provider run by Sony Network Communications, part of the Sony Group.
Breach Details and Scope
The incident, confirmed by Sony Network Communications on October 23, compromised 1,869,771 current So-net members and 272,215 former customers. An additional 443,495 records from its plala (S Course) service were also accessed, including 21,130 former members. The stolen data includes names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. The company lists the cause of the breach as “unauthorized access by a third party” and says the investigation is ongoing.
The breach also exposed the email passwords of 54,401 users across four services. The largest group, 24,655 addresses, uses the free Mail Service (G), and the rest belong to three paid services, the A-Box additional mailbox, So-net VAIO Mail and the PostPet Mail Account Service.
These passwords were reset on October 27 “to prevent the damage from spreading,” and affected users must set new ones through the So-net My Page portal. A separate leak involved 16 bank account records containing bank and branch names, account types, numbers, and holder names. Data from seven notices issued to members for password resets was exposed as well, and those passwords have been reset. No credit card information was taken.
Company Response
After detecting the breach on October 19, So-net immediately shut down the affected server and cut off the unauthorized access source. The company issued a notice on October 27 apologizing for the “great inconvenience and concern” the incident has caused. “We have confirmed an information leak caused by unauthorized access to the member database,” the company said in the notice. The incident has been reported to Japan’s Personal Information Protection Commission.
The company confirmed that its fiber internet service, NURO, and other systems were not impacted. No information leaks have been found in NURO, the company’s fiber internet service, or its other services, according to the notice. Customers who canceled their subscriptions by the end of February 2026 are not affected by the data leak. So-net is currently investigating the cause and reviewing its security measures and information management system.
Customer Warnings and Next Steps
So-net has warned customers that “suspicious communications exploiting the leaked information may arrive in the future.” The company advises users to ignore suspicious emails, texts, or calls and to avoid clicking on links or attachments from unknown sources. “Within the scope of what we know at this time, no secondary damage caused by this incident has been confirmed,” the company said on October 27.
Affected customers will be contacted individually. The company has established a dedicated phone line and an FAQ page for assistance. Sony Network Communications said it takes the incident seriously and will keep looking into its cause “while reviewing our security measures and information management system.”
Separately, PlayStation Network (PSN) users have reported their accounts being hijacked, with unknown child accounts added to family groups. Some claim this happened even with 2FA turned on, and that the email address tied to their account was changed. At the time of writing, Sony Interactive Entertainment had not confirmed a vulnerability, named a cause or released a statement about the reports.
Leave a Reply