Sony’s Japanese ISP So-net Breached, 2.6 Million Subscriber Records Stolen

Sony Network Communications has disclosed that hackers stole personal information belonging to roughly 2.6 million current and former subscribers of its Japanese internet services So-net and Plala. The company announced the breach on October 27, saying attackers first broke into its member database on October 19.

So-net detected the intrusion on October 23 and responded by taking the targeted server offline and blocking traffic from the attackers. By October 24, investigators had confirmed that customer data had been exfiltrated and had mapped the scope of the exposure.

What Was Stolen

The compromised records include names, dates of birth, gender, phone numbers, email addresses, user IDs, and internet connection IDs. Of the roughly 2.6 million affected records, about 2.14 million belong to So-net subscribers and 443,000 to Plala (S Course) subscribers. Around 293,000 of the records relate to former customers who canceled service in March 2026 or later, since So-net retains such data temporarily for billing and support purposes.

In addition, attackers obtained approximately 54,000 email addresses along with their passwords across four services: Mail Service (G), A-Box, So-net VAIO Mail, and PostPet. So-net said it found no evidence that passwords for the free basic mailbox included with subscriptions were leaked.

The breach also exposed 16 records containing bank account details, including bank name, branch, account type, account number, and account holder name. So-net said it does not store PINs for these accounts, and credit card data was not involved since the company does not retain it. NURO and other So-net offerings do not appear to have been affected.

Response and Next Steps

Because the stolen email credentials could let a third party read, send, and receive messages through affected accounts, So-net began forcibly resetting passwords for impacted addresses on October 27, requiring users to set new credentials before regaining access.

So-net has attributed the incident to unauthorized third-party access and says its investigation is ongoing. The company has not disclosed how the attackers gained entry. The breach has been reported to Japan’s Personal Information Protection Commission.