Data breach at Sony-owned internet provider compromises 2.6 million customer records - Help Net Security

So-net, a Japanese internet service provider owned by Sony Network Communications, confirmed the unauthorized access to its member database on October 27. The attackers accessed personal information belonging to more than 2.58 million current and former customers, along with email passwords of 54,401 users. The company apologized to customers for "the great inconvenience and concern" the incident has caused.

The attack took place on October 19, with the company confirming it four days later. "After confirming this, we promptly stopped the affected server and cut off communications from the source of the unauthorized access," the company stated in its notice. The investigation completed on October 23 established that personal data had leaked and identified the categories of information and the number of records involved.

Customer Information Exposed

The stolen So-net records belong to 1,869,771 current members and 272,215 people who left the service in March 2026 or later. Another 443,495 records come from plala (S Course), including 21,130 former members. The leaked information includes names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. "No passwords were leaked" from these membership records, according to the company.

Customers who canceled their subscriptions by the end of February 2026 are not affected by this breach. The company confirmed that no information leaks have been found in NURO, its fiber internet service, or its other services.

Email and Financial Data

A separate part of the leak involves four email services offered to So-net members. For 54,401 addresses, the attackers obtained both the email address and its password. The largest group, 24,655 addresses, uses the free Mail Service (G), with the rest belonging to three paid services. These passwords were reset on October 27 "to prevent the damage from spreading," and affected users must set new ones through the So-net My Page portal.

The breach also includes 16 bank account records containing the name of the bank and branch, account type, account number and account holder name. "We do not hold account PINs," the company stated, adding that no plala customers are affected by this part of the leak. Data from seven notices issued to members for password resets was exposed as well, and those passwords have been reset. None of the leaked data includes credit card information.

Customer Protection Measures

"Within the scope of what we know at this time, no secondary damage caused by this incident has been confirmed," the company said on October 27. It warned, though, that "suspicious communications exploiting the leaked information may arrive in the future." Customers are advised not to respond to emails, text messages or phone calls of that kind, and not to open links or attachments in such messages.

Affected customers will be contacted individually, and a dedicated phone line and an FAQ page have been set up. Sony Network Communications said it takes the incident seriously and will keep investigating its cause "while reviewing our security measures and information management system." The incident has been reported to Japan's Personal Information Protection Commission.

Separate PSN Incident

In a separate incident adding to Sony's security troubles this week, reports spread on X from PlayStation Network (PSN) users claiming their accounts were hijacked. Users report that unknown child accounts were added to their family groups without permission, with some claiming this happened even with two-factor authentication turned on. "I just woke up and I had my email to my psn account change from this stupid child family management exploit where unauthorized accounts are added to your family management where they can see your account information," one user wrote.

At the time of writing, Sony Interactive Entertainment had not confirmed a vulnerability, named a cause or released a statement about the reports. The company continues to face security challenges as it works to protect customer data across its various services.