So-net (Sony): 2.6 million customer records stolen

Sony Network Communications, the Sony Group company that runs the Japanese internet service provider So-net, announced on 27 October 2026 that an unauthorised third party had broken into its customer database and taken 2,585,481 records of current and former customers, plus 54,401 email addresses with their passwords. Help Net Security, BleepingComputer and SecurityWeek report the story consistently, based on the notice published by the company.

What happened

The timeline, as reconstructed by the three sources:

• 19 October: unauthorised access to the So-net customer database;
• 23 October: the company detects it, shuts down the affected server and blocks communications with the source of the access;
• 24 October: the investigation confirms the leak of personal data and establishes its categories and volumes;
• 27 October: public notice, reset of the affected email passwords and report to the Personal Information Protection Commission, Japan’s data protection authority.

Four days therefore passed between the intrusion and its discovery. The only cause given by the company is “unauthorised access by a third party”: the entry vector has not been disclosed and the investigation is ongoing. Specific MITRE ATT&CK techniques cannot be assigned to the intrusion, and no source reports any claim of responsibility.

What data was exposed

Customer records (2,585,481). According to Help Net Security, 2,141,986 are So-net records (1,869,771 current customers and 272,215 people who left the service in March 2026 or later) and 443,495 belong to plala (S Course), including 21,130 former customers. They contain name, phone number, email address, user ID, date of birth, gender and internet connection ID. These records, the company states, contain no passwords. SecurityWeek explains that former customers’ data is kept for a while to handle final bills and support requests; anyone who cancelled by the end of February 2026 is not affected.

BleepingComputer adds that the plala records concern NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services. According to the same outlet, Docomo has notified its customers, says all current Hikari customers and those who cancelled in the previous six months are affected, and is already warning of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan ticket campaign.

Mailboxes (54,401). For four additional email services the attackers obtained both address and password: the free Mail Service (G), with 24,655 addresses, and the paid A-Box, So-net VAIO Mail and PostPet Mail Account Service. For the basic mailbox included with the subscription, SecurityWeek reports, no password theft has been found. In the FAQ quoted by SecurityWeek, the company writes that whoever held the data could read, send and receive email through a mail client or the webmail: this is why it reset the passwords on 27 October, and users must choose a new one from the So-net My Page portal. The sources do not say how the passwords were stored.

Other data. Help Net Security and SecurityWeek also report 16 records with bank account details (bank, branch, account type and number, account holder, but no PINs, which the company says it does not hold), whereas BleepingComputer writes that no banking details were exposed: the sources diverge on this point. Only Help Net Security mentions data from seven password-reset notices sent to customers, whose passwords have already been reset. No credit card data was involved, as So-net does not store it; the NURO fibre service and other services do not appear to be affected.

As of 27 October the company had found no secondary damage, but warns that suspicious messages exploiting the stolen data may arrive.

The context

BleepingComputer places the incident in a series of attacks on Japanese companies and providers in 2026, including KDDI (12 million customers), GMO Internet Group and the ransomware attack on IDC Frontier, and writes that the Japanese government held urgent meetings to plan its response. SecurityWeek recalls, among others, the Nikkei and Japan Digital Agency cases. Finally, Help Net Security reports, as a separate incident not confirmed by Sony Interactive Entertainment, claims of hijacked PlayStation Network accounts: no source links it to the So-net breach.

Why it matters in Europe too

Almost all affected customers are in Japan, but the case touches two issues shared by every provider and anyone managing a large customer base:

• former customers’ data: more than 290,000 records belong to people who had already left the service. Under GDPR and NIS2, storage limitation directly reduces the impact of a breach;
• email services tied to the subscription: with a valid address and password, an attacker can read correspondence, request password resets for other services and send phishing from legitimate mailboxes.

In Italy and across the EU, electronic communications providers fall within the scope of NIS2, with an early warning for significant incidents due within 24 hours; for personal data, the GDPR requires notification to the supervisory authority within 72 hours.

What to do now

If you run a customer database exposed to online services:

• separate personal data from service credentials, with distinct application accounts and least privilege;
• set alerts for bulk queries and exports and for unusual outbound traffic from database servers: here it took four days to notice;
• store passwords only with slow, salted hash functions, and delete or anonymise former customers’ data as soon as billing obligations end;
• prepare a forced credential reset procedure that can be run within hours.

If employees or branches use mailboxes or accounts with a breached provider:

• change the mailbox password and that of any service sharing it, and enable multi-factor authentication where available;
• check recently added forwarding rules and filters in mailboxes: they are a common way to keep access after a reset;
• warn users not to reply to emails, text messages or calls that quote personal data to ask for payments, codes or credentials.

How ARXDOME can help

ARX Expose shows what an attacker sees of your company from the outside, including company accounts involved in known breaches and lookalike domains registered by others, often used in the phishing campaigns that follow a data leak. ARX Sentry collects logs and events from servers and firewalls and flags anomalous activity, helping you spot unusual access and exports sooner.

Last updated: 29 October 2026