Sony Suffers Massive Data Breach - 2.58 Million So-net and Plala Users' Data Exposed - CyberSecurityNews
Sony Network Communications has revealed a data breach exposing 2,585,481 customer records from its So-net and plala internet services.
The company disclosed the incident on October 27, 2026, after discovering unauthorized access to its member database. The exposed information includes contact details, account identifiers, and passwords for selected email services. According to the official So-net notice, the breach affected 2,141,986 So-net records and 443,495 plala records.
The leaked member information includes names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Sony confirmed that the breach did not expose passwords associated with the main membership accounts or credit card information.
Email Credentials Exposed
According to reports, credentials for 54,401 email accounts across four Sony services were exposed: Mail Service (G) (24,655), A-Box (17,672), So-net VAIO Mail (7,005), and PostPet Mail (5,069). Sony reset the affected passwords on October 27 to prevent misuse.
CNET Japan reported that the exposed email credentials could have allowed someone to read, send, and receive messages through email software or So-net Webmail.
This does not establish that attackers actually accessed those mailboxes. Users must set new passwords and update saved credentials in their email applications.
Bank Information and Timeline
Sony also confirmed exposure of 16 bank account records containing details such as bank names, branch information, account numbers, and account holder names. Bank PINs were not stored. Seven records involving password reset notification documents were also exposed, prompting password resets for those affected.
The unauthorized access occurred on October 19. Sony identified the intrusion on October 23, stopped the affected servers, and blocked communications from the source. Investigators confirmed the information leak and established the affected data categories and counts on October 24.
Sony reported the incident to Japan's Personal Information Protection Commission. The company has not disclosed how the attacker entered, a specific software flaw, or the attacker's identity. Its investigation into the cause and full impact remains ongoing.
Related
