Sony's So-net ISP breach exposes 2.14 million records

Sony Network Communications, the internet service provider subsidiary of Sony, has confirmed a data breach affecting its consumer-facing So-net service. In an apology and notification published by the company, it said attackers gained unauthorized access to its systems. Roughly 2.5 million current and former users were affected, and the company identified 2,141,986 sensitive records that were exfiltrated. The stolen files include phone numbers and email addresses, and the email passwords of some users were also compromised.

The identity of the attackers and the method they used to get in have not been disclosed. No hacker group has claimed responsibility so far, and the data has not yet been seen on the dark web. No information about a ransom demand has been shared.

How the attack was discovered

According to the company, the breach took place on Monday, October 19, 2026, and was noticed four days later, on October 23. As soon as it was detected, the affected server was shut down and traffic from the source of the unauthorized access was blocked. An investigation carried out the following day showed that a total of 2,141,986 sensitive records belonging to both current and former members had been taken.

Sony Network Communications said it has reported the incident to the Personal Information Protection Commission and other relevant government and law enforcement bodies, and that the investigation is continuing.

What data was stolen

About 1.8 million of the records belong to current members. For these users, attackers obtained names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. The company stressed that passwords in this group were not leaked.

A further 440,000-plus records from the plala (S Course) service were also taken. This portion extends to NTT Docomo, a separate internet service provider that uses Sony Network Communications' infrastructure. NTT Docomo issued its own statement warning customers not to respond to emails, text messages or phone calls, and not to open links or attachments in messages. The company pointed to the risk that the leaked information could later be misused for suspicious contact attempts. The incident reportedly covers all Hikari service customers, as well as those who cancelled their subscriptions from May 2026 onward.

Email passwords and bank details

Email addresses and email passwords of some So-net members were also stolen. The number of affected addresses was given as 24,655 for Email Service (G), 17,672 for A-Box, 7,005 for So-net VAIO Mail and 5,069 for PostPet Mail Account Service. The breach also covers former customers who cancelled in March 2026 or later; those who left before the end of February were not affected.

Banking data concerns a very small number of people. The company confirmed that 16 records were leaked, containing the name of the financial institution, bank and branch codes, account type, account number and the account holder's name. It stressed that PIN details for bank accounts are not stored by the company and therefore could not have been obtained. Affected customers will be contacted individually and apologized to.

The attack came less than a week after the Japanese internet company GMO Group told its customers to scan their computers for viruses, back up their data, and disconnect and shut down their devices.