Sony Unit So-net Says Breach Leaked 2.59M Member Records

Sony Network Communications, a wholly owned Sony Group subsidiary, said on Oct 27 that its So-net member database was accessed without authorization. So-net is the company's internet connection service, which makes it an internet service provider (ISP) in Japan. Sony says up to about 2.59 million member records leaked, 2,585,481 in total: 2,141,986 So-net records and 443,495 plala (S Course) records. Sony counts records, not people, and does not say how many individuals are affected. Per Sony's notice, they cover current members and people who left in March 2026 or later; members who left by the end of February 2026 were not affected.

Timeline (Japan time). Sony says the unauthorized access happened on Oct 19 and that it confirmed it on Oct 23, then promptly stopped the affected servers and blocked traffic from the source. On Oct 24 it established that personal information had leaked and how much. It disclosed the incident on Oct 27 and has reported it to Japan's Personal Information Protection Commission. Sony gives the cause as unauthorized access by a third party, which is still under investigation. It has not said who was behind the attack or how they got in.

What leaked. The member records include names, phone numbers, email addresses, user IDs, dates of birth, gender and internet-connection IDs. Sony says passwords were not part of those records and that no credit card data leaked. It did confirm that 16 records with bank-account details leaked (bank, branch, account type, account number and holder name; Sony says it holds no account PINs), along with seven password-reset notice records.

Email passwords. Separately, Sony says email-account passwords tied to 54,401 email addresses on four mail services also leaked: Mail Service G, A-Box, So-net VAIO Mail and PostPet mail. Sony's FAQ suggests these are part of the overall total rather than on top of it. Sony reset those passwords on Oct 27, and affected users must set new ones through So-net My Page. Sony says it has found no secondary harm so far.

Docomo's role. According to NTT Docomo's notice, Docomo entrusts the So-net member database to Sony Network Communications for plala (S Course), the internet service offered with Docomo Hikari fiber. Docomo says the 443,495 plala records cover current plala (S Course) users and people who canceled within the past six months, and that it will notify affected customers individually. Docomo says its other Hikari and plala services were not affected.

The incident was first reported in English by BleepingComputer. This story relies on Sony's and Docomo's own notices for the figures above.