So-net Data Breach Affected 2.58 Million Records, Including Email Passwords
Sony Network Communications confirmed unauthorized access to the So-net database. The incident involves more than 2.58 million records, and passwords for some email accounts were also exposed.
The So-net data breach affected a total of 2,585,481 records belonging to So-net and plala (S Course) service members. Sony Network Communications said unauthorized access to the member database occurred on October 19, 2026, and that it confirmed the incident on October 23. It published a public notice on October 27 and updated it on October 29.
According to the company, the incident involves 2,141,986 So-net member records and 443,495 plala members in the S Course program. These are record counts in individual categories; the notice does not reliably determine the number of unique people affected by the breach.
The So-net data breach includes contact and identifying information
The information that the unauthorized party may have accessed includes names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection identifiers.
The company separately confirmed the exposure of passwords for 54,401 email accounts across four older or supplementary email services. These are not passwords for regular So-net member accounts or for basic mailboxes using the @…so-net.ne.jp domain.
The company also reported 16 bank records and seven records containing password-reset notices. According to the company, payment card data was not part of the incident.
The company took the server offline and reset affected passwords
Sony Network Communications said it took the affected server offline and blocked communication from the source of the unauthorized access. It reset passwords for the affected email services on October 27. It reported the case to Japan’s Personal Information Protection Commission.
As of October 27, the company had no confirmed cases of secondary misuse of the exposed data. It also did not report a breach involving the NURO service or other services outside the published scope.
Phishing and reused passwords are risks
The combination of names, contact details, and other identifiers could be used in convincing phishing messages or phone scams. For the 54,401 accounts, the exposure of email passwords is a particular risk, especially if users also used them with other services.
The password reset performed by the provider limits further access to the affected mailboxes. However, it has not been confirmed whether the attacker used these passwords before the reset or whether they were reused elsewhere.
The cause of the intrusion remains unknown
The company is continuing its investigation. It has not disclosed the cause of the incident, the technique used in the intrusion, or the attacker’s identity. It is also necessary to monitor whether the reported scope of the affected services or the number of records changes and whether confirmed cases of phishing, fraud, or other secondary misuse of the data emerge.
Sources
- So-net / Sony Network Communications – Primarily confirms the unauthorized access, timeline, scope and categories of exposed data, email password resets, notification to the regulator, and the status of the investigation.
- BleepingComputer – Independently reports on the confirmed incident and approximately 2.5 million customer records.
- SecurityWeek – Corroborates the scope of the incident and highlights the separate category of exposed email passwords.
Verified and updated: October 29, 2026, 15:28
