Sony So-net Breach Leaks 2.58M Records and Email Passwords

Most of what leaked from So-net is the usual breach inventory: names, phone numbers, birthdays. The part that should worry you is smaller. Sony Network Communications, the Sony Group company that runs the So-net internet service in Japan, says an attacker also took 54,401 email addresses together with their mailbox passwords. A stolen mailbox is not one more leaked account. It is the account that resets all the others.

Key Takeaways

• Sony Network Communications says an outside party accessed the So-net member database on October 19, 2026, which it confirmed on October 23 and disclosed on October 27.
• 2,585,481 customer records leaked: 2,141,986 So-net records and 443,495 records of plala (S Course) customers, a service NTT Docomo sells as part of Docomo Hikari.
• 54,401 So-net email addresses leaked with their mailbox passwords, and Sony reset all of those passwords on October 27.
• Sony's own notice also lists 16 leaked bank account records and 7 password reset notices, even though early English coverage said no banking details were exposed.
• Sony and Docomo both warn that the leaked data may be used for suspicious emails, SMS and calls, and say no secondary harm had been confirmed as of October 27.

What Happened at Sony So-net?

An unauthorized third party broke into the So-net member database, the system behind Sony's consumer internet access service. The official Sony Network Communications notice (in Japanese) gives this timeline:

• Monday, October 19: the attacker accessed the database from outside.
• Friday, October 23: Sony confirmed the access, shut down the affected servers and blocked traffic from the attacker's source.
• Saturday, October 24: the investigation established that personal data had leaked, and which fields and how many records.
• Tuesday, October 27: public disclosure, plus a forced reset of every leaked mailbox password.

Sony lists the cause only as third party access, still under investigation, and has reported the incident to Japan's Personal Information Protection Commission.

What Data Was Exposed?

The answer depends on which bucket you fall into. Sony's notice splits the leak into five parts:

• So-net members (2,141,986 records): 1,869,771 current members and 272,215 former members who left in or after March 2026. Fields: name, phone number, email address, user ID, date of birth, gender and internet connection ID. No passwords.
• So-net mailboxes with passwords (54,401 addresses): 24,655 on the free Mail Service (G) domains (gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp), 17,672 A-Box extra mailboxes on so-net.ne.jp, 7,005 So-net VAIO Mail addresses on vaio.ne.jp, and 5,069 PostPet addresses.
• plala (S Course) members (443,495 records): 422,365 current and 21,130 former customers, with the same fields as So-net members and no passwords.
• Bank account details (16 records): bank name, branch, account type, account number and holder name. Sony says it never held account PINs, and no plala customers are in this group.
• Password reset notices (7 records): Sony reinitialized those passwords.

None of the five groups includes credit card data, and Sony says it found no leak from NURO or its other services. Members who left by the end of February 2026 are not affected.

One detail the first wave of English coverage got wrong: BleepingComputer wrote that no banking, payment card, or other account details were exposed. Sony's own notice confirms 16 leaked bank account records. Those 16 customers should not read early headlines as an all clear. Bank details were also the sensitive slice when Aflac's Japan subsidiary lost bank account data earlier this year.

Why Are the 54,401 Email Passwords the Biggest Risk?

A leaked mailbox password lets an attacker read your mail and send as you. Worse, it lets them request password resets for every service that sends reset links to that address. Names and birthdays make phishing more convincing. A working mailbox login skips the phishing step entirely.

Look at which mailboxes are on the list: extra A-Box mailboxes, VAIO Mail, PostPet and free addresses on four secondary domains. These are rarely anyone's main inbox. Secondary addresses are often the ones people registered long ago as a login or recovery address, then stopped reading. An address you rarely check is exactly where a password reset email can arrive without you noticing.

Sony reset all 54,401 passwords on October 27. That closes the mailbox itself, but not two other gaps. First, the passwords sat with the attacker from October 19 until the reset, eight days in which they could have been tried. Second, Sony's reset protects nothing outside So-net. If you used the same password for Gmail, Amazon or online banking, the leaked copy still works there. Sony's notice does not say how the passwords were stored, so assume the attacker can read them.

Is Docomo Hikari Affected?

Yes, for one plan. NTT Docomo contracts Sony Network Communications to run plala (S Course), and Docomo's customer notice says Sony told it about the breach on October 26. The 443,495 affected records belong to Docomo Hikari plala (S Course) customers who are current or cancelled within the last six months. Docomo says other plala plans, including plala (Docomo Hikari), are not affected.

Docomo says the leaked plala data contains no passwords and no payment information, and that the exposed email addresses are So-net addresses.

On the same day, Docomo published a separate phishing warning about emails that impersonate d POINT Club and claim you won a Universal Studios Japan campaign prize, then push you to a site to issue tickets and enter personal details. Docomo says it runs no such campaign. Its notice does not link that lure to the So-net leak, but it is exactly the kind of email a fresh list of names and addresses makes easier to send.

What This Means for Your Inbox

This is the second time in 2026 that a Japanese ISP breach has handed attackers email logins. In June, KDDI disclosed that up to 14.2 million email addresses and passwords across six ISPs may have been exposed. So-net's 54,401 mailboxes are a far smaller set, but the lesson is the same: the email account your ISP gave you is often the least protected account you own, and it guards the most.

Gmail users are not out of scope. If your ISP address is the recovery email on your Google account, that mailbox is a side door into Google: whoever controls it can receive the codes sent by Google's account recovery flow. Western providers have the same weak point: this week DreamHost forced email password resets and told customers to look for forwarding rules they did not create.

Then there is phishing. With names, birthdays and user IDs, a fake So-net or Docomo email can quote real account details. After the Free Mobile breach in France, phishing emails copied the provider's real templates. Expect fake So-net password reset emails in particular, since 54,401 customers are already being told to reset.

What Should So-net and plala Customers Do Now?

Start with the mailbox, then work outward. Sony's Q&A page for this incident and the So-net hotline (0120-36-8887) cover account specific questions.

1. Set a new mailbox password. If you use Mail Service (G), A-Box, So-net VAIO Mail or PostPet, your password was already reset. Type the address of So-net My Page yourself to set a new one, and never use a link from an email.
2. Retire the old password everywhere. Change it on every site where you reused it, starting with any account that uses the So-net address as its login.
3. Check mailbox settings. Look for forwarding addresses, auto replies or filters you did not create. Attackers add them so copies of your mail keep flowing after you change the password.
4. Check where the address is a recovery contact. In your Google account and other major services, confirm the recovery email and phone are ones you control, and turn on two step verification.
5. Treat So-net, Docomo and d POINT emails as suspect for now. Sony and Docomo both advise not replying to suspicious emails, SMS or calls, not opening links, and not opening attachments.
6. If you are one of the 16 bank account holders, wait for Sony's individual notice, tell your bank, and watch for calls or emails that quote your account number.

Looking Ahead

Sony still has to explain how the attacker got in and how the mailbox passwords were stored. Compliance teams will also ask why 272,215 So-net and 21,130 plala records of cancelled customers sat in the same live database. The Personal Information Protection Commission now has the case. Until Sony publishes more, treat it this way: your So-net address is compromised until you have changed its password, checked its settings, and stopped reusing what leaked.

The same week, Japan Airlines disclosed that attackers had read 92,000 passengers' booking records through Amadeus.