Sony's So-net ISP member database breached, 2.58 million records and 54,401 email passwords leaked
So-net and plala (S course) internet services (Sony Network Communications)
Sony Network Communications, which runs the Japanese internet provider So-net, disclosed on Oct 27 2026 that an attacker got into its So-net member database on Oct 19. It found the access on Oct 23 and shut the server down. Names, phone numbers, email addresses, user IDs, birth dates, gender and internet connection IDs leaked for 2,141,986 So-net members and 443,495 plala (S course) customers of NTT Docomo's Docomo Hikari, including people who left since March 2026. Email addresses and their mailbox passwords leaked for 54,401 addresses on four mail services, plus 16 bank account records. Member login passwords and card data were not exposed. The cause is still under investigation.
Why this severity: 2.58 million ISP customer records, with working mailbox passwords for 54,401 addresses that let attackers read and send mail until the Oct 27 reset
- Started
- Oct 19, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline4
Sony Network Communications discloses the breach: 2,585,481 So-net and plala (S course) member records, email passwords for 54,401 addresses on four mail services (force-reset from about 10:00 JST), 16 bank account records and 7 password-reset notices. NTT Docomo separately confirms 443,495 Docomo Hikari plala (S course) customers are affected.
The investigation confirms personal data was leaked and establishes which fields and how many records were taken.
Sony Network Communications discovers the access, shuts down the affected server and blocks traffic from the attacker.
An outside party gains unauthorized access to the So-net member database run by Sony Network Communications.
Advisories3
News & write-ups2
Posts1
So-net、会員データベースへの不正アクセスで会員情報約214万件などが漏えい。一部退会者も含む Plala（Sコース）会員情報も対象 t.co/Dqj33eGZwd
Notes & caveats
The intrusion method has not been disclosed; Sony Network Communications says it is still investigating and has reported the breach to Japan's Personal Information Protection Commission. NURO and other Sony Network Communications services are not affected according to the company. No secondary damage was known as of Oct 27.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
