Sony Network Communications says an intruder reached a member database for its So-net and plala internet services, exposing 2,585,481 customer records. Most of the data is contact and profile information, but 54,401 email account passwords were also exposed, which raises the risk of mailbox takeover and convincing phishing.
What happened
According to reporting based on Sony’s notice, the unauthorized access took place on October 19, 2026. Sony found the intrusion on October 23 and confirmed on October 24 that data had leaked. It stopped the affected server, blocked traffic from the source of the access, and reset the exposed email passwords on October 27, the day it disclosed the incident. Sony also reported the incident to Japan’s Personal Information Protection Commission.
The total breaks down into 2,141,986 So-net records and 443,495 plala (S Course) records. The figures are records, not a verified count of unique people, and they include former members who cancelled from March 2026 onward: 272,215 for So-net and 21,130 for plala. Customers who left before then were not affected, according to the reports.
Who is affected
Current and recent former subscribers of So-net and plala internet services. Across the member records, the exposed fields were:
- Name, phone number, email address, user ID, date of birth, gender and internet connection ID.
- Email addresses and passwords for 54,401 accounts across four email services: Mail Service (G), A-Box, So-net VAIO Mail and PostPet Mail.
- Bank details, including account numbers and holder names, in 16 records. Sony says it does not store bank PINs.
- Seven password-reset notification documents.
Sony says passwords for the main membership accounts and credit card information were not exposed. INTERNET Watch reports the company has seen no secondary harm so far, but has warned that suspicious messages could follow.
What to do
This section is our analysis, based on the exposed data types and general practice.
- If you use any of the four affected email services, change that password now and update it in every mail app and device. Sony reset the exposed passwords, but you should still choose a new one.
- Do not reuse that password anywhere else. If you did, change it on those sites too and turn on two-factor authentication.
- Treat unexpected messages that mention your name, birth date or phone number with suspicion. Go to the official So-net or plala site directly instead of following links in emails or texts.
- Check mailbox rules, forwarding settings and recovery addresses for changes you did not make.
- If you are among the 16 records with bank details, watch your account activity and contact your bank if you see anything unusual.
What we still do not know
Sony has not said how the attacker got in, whether a software flaw was involved, or who is responsible. It has not explained the gap between the October 19 access and its October 23 discovery. It has also not said how many unique people are behind the 2.59 million records, and it has not confirmed whether the data is being sold or published. Sony’s investigation is ongoing, and reports say no link has been established to its separate MOVEit-related breach.
Sources: INTERNET Watch (Oct. 27, 2026); Cyber Security News (Oct. 28, 2026); Beebom (Oct. 27, 2026).
Leave a Reply