Attackers who broke into the So-net member database made off with personal information belonging to more than 2.58 million current and former customers, along with the email passwords of 54,401 users, Sony Network Communications has disclosed.
So-net is a Japanese internet service provider run by Sony Network Communications, part of the Sony Group.
“We have confirmed an information leak caused by unauthorized access to the member database,” the company said in a notice published on October 27, apologizing to customers for “the great inconvenience and concern” the incident has caused.
No information leaks have been found in NURO, the company’s fiber internet service, or its other services, according to the notice.
Four days before discovery
The attack on the database took place on October 19, and the company confirmed it on October 23. “After confirming this, we promptly stopped the affected server and cut off communications from the source of the unauthorized access,” the notice reads.
An investigation completed the next day established that personal data had leaked and identified the categories of information and the number of records involved.
The company lists the cause of the breach as “unauthorized access by a third party” and says the investigation is ongoing. The incident has been reported to Japan’s Personal Information Protection Commission.
Former customers among those affected
The stolen So-net records belong to 1,869,771 current members and 272,215 people who left the service in March 2026 or later, for a total of 2,141,986. Another 443,495 records come from plala (S Course), including 21,130 former members.
In both cases, the leaked information includes names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. “No passwords were leaked,” the company noted about these membership records. Customers who canceled their subscriptions by the end of February 2026 are not affected.
Email passwords and bank details exposed
A separate part of the leak involves four email services offered to So-net members. For 54,401 addresses, the attackers obtained both the email address and its password.
The largest group, 24,655 addresses, uses the free Mail Service (G), and the rest belong to three paid services, the A-Box additional mailbox, So-net VAIO Mail and the PostPet Mail Account Service.
These passwords were reset on October 27 “to prevent the damage from spreading,” and affected users must set new ones through the So-net My Page portal.
The leak also includes 16 bank account records containing the name of the bank and branch, account type, account number and account holder name. “We do not hold account PINs,” the company stated, adding that no plala customers are affected by this part of the leak. Data from seven notices issued to members for password resets was exposed as well, and those passwords have been reset.
None of the leaked data includes credit card information.
Customers warned of scam messages
“Within the scope of what we know at this time, no secondary damage caused by this incident has been confirmed,” the company said on October 27. It warned, though, that “suspicious communications exploiting the leaked information may arrive in the future.”
Customers are advised not to respond to emails, text messages or phone calls of that kind, and not to open links or attachments in such messages. Affected customers will be contacted individually, and a dedicated phone line and an FAQ page have been set up.
Sony Network Communications said it takes the incident seriously and will keep looking into its cause “while reviewing our security measures and information management system.”
PSN users report hijacked accounts
In a separate incident that adds to Sony’s security troubles this week, reports spread on X from PlayStation Network (PSN) users who say their accounts were hijacked and unknown child accounts were added to their family groups without permission. Some claim this happened even with 2FA turned on, and that the email address tied to their account was changed.
“I just woke up and I had my email to my psn account change from this stupid child family management exploit where unauthorized accounts are added to your family management where they can see your account information,” one user wrote.
At the time of writing, Sony Interactive Entertainment had not confirmed a vulnerability, named a cause or released a statement about the reports.
