# Sony's So-net ISP member database breached, 2.58 million records and 54,401 email passwords leaked · pwn.watch > Sony Network Communications, which runs the Japanese internet provider So-net, disclosed on Oct 27 2026 that an attacker got into its So-net member database on Oct 19. It found the access on Oct 23 and shut the server down. Names, phone numbers, email addresses, user IDs, birth dates, gender and internet connection IDs leaked for 2,141,986 So-net members and 443,495 plala (S course) customers of NTT Docomo's Docomo Hikari, including people who left since March 2026. Email addresses and their mailbox passwords leaked for 54,401 addresses on four mail services, plus 16 bank account records. Member login passwords and card data were not exposed. The cause is still under investigation. Page: https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026 · generated 2026-10-28T00:00:52.133Z ## Status - Severity: high · status: live · patch: partial - Product: So-net and plala (S course) internet services (Sony Network Communications) - Started: 2026-10-19 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026.json - This file: https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: Sony Network Communications discloses the breach: 2,585,481 So-net and plala (S course) member records, email passwords for 54,401 addresses on four mail services (force-reset from about 10:00 JST), 16 bank account records and 7 password-reset notices. NTT Docomo separately confirms 443,495 Docomo Hikari plala (S course) customers are affected. (https://www.so-net.ne.jp/info/2026/20261027_0001.html) - 2026-10-24: The investigation confirms personal data was leaked and establishes which fields and how many records were taken. (https://www.so-net.ne.jp/info/2026/20261027_0001.html) - 2026-10-23: Sony Network Communications discovers the access, shuts down the affected server and blocks traffic from the attacker. (https://www.so-net.ne.jp/info/2026/20261027_0001.html) - 2026-10-19: An outside party gains unauthorized access to the So-net member database run by Sony Network Communications. (https://www.so-net.ne.jp/info/2026/20261027_0001.html) ## Fix brief # Security brief: Sony's So-net ISP member database breached, 2.58 million records and 54,401 email passwords leaked Source: https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 23:59 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Sony Network Communications, which runs the Japanese internet provider So-net, disclosed on Oct 27 2026 that an attacker got into its So-net member database on Oct 19. It found the access on Oct 23 and shut the server down. Names, phone numbers, email addresses, user IDs, birth dates, gender and internet connection IDs leaked for 2,141,986 So-net members and 443,495 plala (S course) customers of NTT Docomo's Docomo Hikari, including people who left since March 2026. Email addresses and their mailbox passwords leaked for 54,401 addresses on four mail services, plus 16 bank account records. Member login passwords and card data were not exposed. The cause is still under investigation. Severity detail: 2.58 million ISP customer records, with working mailbox passwords for 54,401 addresses that let attackers read and send mail until the Oct 27 reset - Product: So-net and plala (S course) internet services (Sony Network Communications) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you have a So-net or Docomo Hikari plala (S course) account, or left one after February 2026, expect targeted phishing by email, SMS and phone that quotes your name, birth date and user ID; don't click links or open attachments in unexpected messages. If you use Mail Service (G) (gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp), A-Box, So-net VAIO Mail or PostPet mail, set a new mailbox password through So-net My Page, and change the password anywhere else you reused it. Check mail-forwarding and auto-reply settings in case someone changed them before the reset. ## Latest updates - Oct 27, 2026: Sony Network Communications discloses the breach: 2,585,481 So-net and plala (S course) member records, email passwords for 54,401 addresses on four mail services (force-reset from about 10:00 JST), 16 bank account records and 7 password-reset notices. NTT Docomo separately confirms 443,495 Docomo Hikari plala (S course) customers are affected. - Oct 24, 2026: The investigation confirms personal data was leaked and establishes which fields and how many records were taken. - Oct 23, 2026: Sony Network Communications discovers the access, shuts down the affected server and blocks traffic from the attacker. - Oct 19, 2026: An outside party gains unauthorized access to the So-net member database run by Sony Network Communications. ## Advisories - [So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ](https://www.so-net.ne.jp/info/2026/20261027_0001.html) (Sony Network Communications) - [So-net会員データベースへの不正アクセスに関するご質問と回答](https://www.so-net.ne.jp/support/faq/qa202610_01/) (Sony Network Communications) - [【お詫び】ドコモ光「plala（Sコース）」をご利用のお客さま情報流出に関するお知らせ](https://www.docomo.ne.jp/info/notice/page/261027_05_m.html) (NTT Docomo) ## Write-ups & news - [So-net、会員情報約259万件が漏えい　一部メールサービスではパスワードも流出](https://www.itmedia.co.jp/news/article/2610/27/2000002643/) - [Sony discloses data breach exposing 2.6 million customer records](https://cyberinsider.com/sony-data-breach/) ## Caveats The intrusion method has not been disclosed; Sony Network Communications says it is still investigating and has reported the breach to Japan's Personal Information Protection Commission. NURO and other Sony Network Communications services are not affected according to the company. No secondary damage was known as of Oct 27. --- Machine-readable: https://pwn.watch/i/sony-so-net-member-database-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.