Sony ISP breach reportedly exposes 2,585,481 customer records

Sony Network Communications, a Sony Group subsidiary that runs the So-net internet service in Japan, said an unauthorised party accessed its member database on 19 October 2026. The company discovered the intrusion four days later, shut down the affected server and blocked external communication. An investigation confirmed on 24 October that data had been leaked.

Scope of the breach

Sony reported that 2,585,481 customer records were exposed. They split into 2,141,986 So-net membership records and 443,495 plala (S Course) records, a service that Sony runs under NTT Docomo’s Hikari internet contract. In addition, passwords for 54,401 legacy So-net email accounts were exposed.

The exposed information includes names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony says no credit-card information was included. The breach also exposed 16 bank-account records, which list institution names, branch details, account types and numbers, though Sony says it does not hold bank PINs.

Sony forced a password reset for the 54,401 affected email accounts on 27 October. The company also warned customers to change passwords reused on other accounts and to be wary of phishing emails or calls that use personal details. Sony reported the incident to Japan’s Personal Information Protection Commission and is still investigating its cause.

Sony says the breach does not affect PlayStation Network accounts. NTT Docomo, which contracts the plala S Course service to Sony, also warned customers of phishing emails and fake sites impersonating its d POINT Club and a Universal Studios Japan promotion. Neither company had confirmed misuse of the data as of 27 October, though Sony warns the exposed details could be used for suspicious communications.