Sony Network Communications says hackers stole nearly 2.6 million ISP customer records

Sony Network Communications said on Oct. 27, 2026, that hackers stole personal data from nearly 2.6 million current and former So-net and Plala subscriber records, in an intrusion that began on Oct. 19.

So-net is a Japanese internet service provider operated by Sony Network Communications, part of the Sony Group. The company put the exact total at 2,585,481 customer records, with 2,141,986 from So-net and 443,495 from plala (S Course). About 293,000 of the exposed records belong to people who left in March 2026 or later, including 272,215 former So-net members and 21,130 former plala members. Customers who canceled by the end of February 2026 are not affected, and no passwords leaked for the membership records.

The stolen membership data includes internet connection IDs, user IDs, e-mail addresses, phone numbers, gender, dates of birth, and names. So-net found no password leak for the free basic mailbox included with a subscription. Data from seven password-reset notices sent to members was also exposed, and those passwords were reset.

Attackers obtained e-mail addresses and passwords for 54,401 accounts across Mail Service (G), A-Box, So-net VAIO Mail, and PostPet Mail Account Service. The largest group is 24,655 addresses on the free Mail Service (G); other addresses belong to three paid services. So-net says a party holding the leaked e-mail addresses and passwords could view, send, and receive e-mail through e-mail software and So-net Webmail.

Sony Network Communications described the password resets as an emergency measure to stop unauthorized use of customers’ e-mail addresses. On Oct. 27, 2026, the company began resetting exposed e-mail passwords for the affected accounts; users must set new credentials via the So-net My Page portal.

Sony Network Communications reports 16 exposed bank account records containing bank and branch names, account type, account number, and holder name; it holds no PINs. BleepingComputer reported that banking, payment card and other account details were not exposed, which disputes the bank-account reports. So-net does not store credit card data, so the breach involved no credit card data.

The intrusion into the So-net member database occurred on Oct. 19, and Sony Network Communications detected it on Oct. 23, four days later. The company shut down the affected server and blocked traffic from the attackers after detection. By Oct. 24, the company’s investigators confirmed that personal information had been stolen and identified what data and how many records were involved.

Sony Network Communications says an unauthorized third party caused the breach, and the investigation is ongoing; the company has not disclosed the entry method. The company said it will keep investigating while reviewing security measures and information management. It apologized for the inconvenience and concern to affected customers.

NURO fiber internet and the company’s other services were not affected. NTT Docomo contracts Sony Network Communications for Docomo Hikari services and told its customers about the breach. Docomo says the incident affects all current Hikari clients and former customers who canceled within the last six months. That contract relationship ties the plala (S Course) records to Docomo Hikari.

Japan’s government convened urgent meetings on Monday to plan a response to a wave of corporate data breaches affecting Japanese companies. A KDDI breach affected 12 million customers, and ransomware hit IDC Frontier. Malware hit GMO Internet Group’s Onamae Desktop Cloud, and hackers stole data from 18,000 NTT corporate customers in early 2025. The reports cover breaches at telecommunications carriers, cloud providers, and internet companies.

Docomo told customers about phishing e-mails and fake sites that impersonate its d POINT Club and a Universal Studios Japan campaign. Separately, PlayStation Network users reported hijacked accounts and unauthorized child accounts added to family groups; Sony Interactive Entertainment had not confirmed a cause.

The incident was reported to Japan’s Personal Information Protection Commission. By Oct. 27, 2026, Sony Network Communications and NTT Docomo had not confirmed that the exposed data was being misused.

Sony Network Communications warned customers that suspicious messages using the leaked data could arrive later. The company advised customers not to respond to suspect e-mails, texts, or calls or open links and attachments.