Sony Network Communications, the Sony Group subsidiary that runs the So-net and plala internet services in Japan, disclosed on October 27, 2026 that an outside party got into its member database and that 2,585,481 customer records were leaked. That is about 2.6 million records, and they include people who had already left the service.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The company said the intrusion happened on October 19, but it did not find it until October 23 and did not confirm that personal information had left the building until October 24. It has not said how the attacker got in. Investigators were still working on that question when the notice went out.
What the 2,585,481 records are made of
In its press release, the company splits the total into 2,141,986 So-net member records and 443,495 plala (S course) member records. The So-net figure covers 1,869,771 current members and 272,215 former members who left since March 2026. The plala figure covers 422,365 current and 21,130 former members. Fields include name, phone number, email address, user ID, date of birth, gender and internet connection ID, according to Impress Watch.
The company states that member account passwords were not in the leaked databases and that no credit card data was involved. Separate from the 2.6 million, 16 records carried bank account details, including institution, branch, account type, account number and holder name, and 7 records were password reset notices. Sony Network Communications says it does not hold account PINs.
Former customers make up 293,345 of the 2,585,481 records, the sum of 272,215 former So-net members and 21,130 former plala members who left since March 2026. For them the practical risk is the one the company names: names, phone numbers and birth dates held by someone who can send a convincing message to a person who no longer expects mail from the provider.
The email passwords were reset on October 27
One category did include passwords. A set of 54,401 email address and email password pairs was taken, spread across four mail products: 24,655 on the free Mail Service (G), 17,672 on the paid A-Box mailbox, 7,005 on So-net VAIO Mail and 5,069 on PostPet mail. Business-technology outlet SBBIT reported that the company initialized those passwords on October 27 and that affected users must set a new one from the My Page account portal.
BleepingComputer, whose report on the breach described it as roughly 2.5 million records, counted the same current and former customers. The company’s own breakdown rounds to 2.6 million, and that is the figure used here. The company said it stopped the affected server and blocked the source of the connection on October 23, and it reported the incident to Japan’s Personal Information Protection Commission on October 27.
Sony says it will contact affected people directly. It has not confirmed any misuse or secondary harm as of its October 27 notice, and it warns customers to be careful with suspicious email, text messages and phone calls, which is the usual next step after a leak of names, phone numbers and birth dates.
Customers with questions can reach a So-net dedicated line at 0120-36-8887, according to SBBIT, and plala customers can call Docomo’s line at 0120-035-700 between 10 a.m. and 7 p.m. Docomo also told customers that a so-net.ne.jp address can be changed through My Page, although the part after the @ sign cannot be altered.
NTT Docomo’s notice and who is on the hook
The plala records tie the breach to a second company. NTT Docomo, which sells the Docomo Hikari plala (S course) service on top of Sony Network Communications’ systems, said in its own notice that the member database server was operated by Sony Network Communications as a contractor. Docomo received Sony’s report on October 26 and published its notice the next day. It said the 443,495 affected plala records belong to current customers and to those who cancelled within the previous six months, and that other plala and Docomo Hikari customers were not affected.
The target is not unfamiliar. In July 2025, ScanNetSecurity reported that So-net had confirmed accounts whose email addresses were changed without the owner’s intent in a password list attack, where credentials stolen elsewhere are tried against a login page. Nothing in the October notice connects the two events.
Neither the Sony release nor the Docomo notice names an executive. The release lists only the company’s Corporate Communications Department, Public Relations Section as the press contact, and Docomo points customers to a dedicated plala phone line. The reports reviewed do not say whether a ransomware or extortion group is behind the access, and the October 24 confirmation of a leak suggests the data had already been published or offered somewhere. Where it went, and whether the 54,401 mailboxes were read before the reset, are the details the investigation still owes former customers who assumed their accounts were closed.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
