Sony's So-net ISP breach exposes 2.58M customer records

Sony Network Communications, the Sony Group subsidiary that runs the So-net ISP in Japan, disclosed on 27 October 2026 that an intrusion exposed 2,585,481 customer records. The company reported the incident to Japan's Personal Information Protection Commission and is still investigating cause and scope. No threat actor has claimed responsibility.

What was exposed

The 2,585,481 figure breaks down as 2,141,986 So-net records and 443,495 plala (S Course) records. The plala data belongs to NTT Docomo customers — Sony Network Communications operates the back end for Docomo's "Docomo Hikari" fiber service. Exposed fields, per the company, are full names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.

Separately, 54,401 email addresses were exposed together with their account passwords across several of the company's email services. Japanese reporting (Nikkei, ITmedia) also notes 16 bank-account records and 7 password-reset notification records among the leaked data. The company says no credit-card or payment data was exposed, and that services such as NURO were not affected.

Timeline

• 19 October — the unauthorized access occurred.
• 23 October — detected; the company shut down the affected servers and blocked communication from the source.
• 24 October — investigation confirmed personal data had leaked.
• 27 October — public disclosure and notification to the PIPC.

Docomo says the exposure covers all current Hikari clients plus anyone who canceled in the preceding six months.

Action checklist

1. If you hold a So-net or affiliated email account, reset the password now. The company has already force-reset the 54,401 affected email passwords; users set a new one from My Page.
2. Reuse that password anywhere else? Rotate it there too — the exposed address/password pairs are the immediate credential-stuffing risk.
3. Expect targeted phishing. NTT Docomo has warned of fake emails and sites impersonating its d POINT Club and a Universal Studios Japan prize campaign, soliciting personal data. The leaked names, birth dates and connection IDs make those lures more convincing.
4. Docomo Hikari customers: treat any unsolicited "account verification" contact referencing your service as suspect until confirmed through official channels.

Context

Japan has absorbed a run of large consumer-data breaches this year — the Nikkei developer-system breach hit 1.83 million, and Burger King Japan exposed 11 million app records. This one stands out less for its size than for the Docomo blast radius: a telecom back-end relationship turned a single ISP intrusion into a notification obligation for a second carrier's subscribers. With no actor named and the investigation open, the attribution and the entry vector are the questions still outstanding.