Sony’s Internet Provider So-net Loses 2.6 Million Subscriber Records, and 54,000 Email Passwords Went With Them

The intruder was inside for four days before anyone noticed. When Sony Network Communications, the Sony Group company that runs the So-net internet service in Japan, finally pulled the plug, close to 2.6 million subscriber records had been taken, along with something more immediately dangerous: tens of thousands of working email passwords.

Our account is based on SecurityWeek’s coverage of the So-net breach, with additional details from BleepingComputer.

How it unfolded

October 19: An unauthorized party gets into the So-net member database that supports the company’s internet access service.
October 23: The company spots the intrusion, takes the targeted server offline and blocks the attacker’s traffic.
October 24: Investigators confirm that personal data was taken and work out how much.
October 27: Sony Network Communications announces the breach and starts forcing password resets on the affected email accounts. Japan’s privacy regulator, the Personal Information Protection Commission, has been notified.

Whose data, and how much

The company counts 2,585,481 exposed records. So-net customers account for about 2.14 million of them, and roughly 443,000 come from to subscribers of Plala (S Course), a service Sony Network Communications runs under contract for NTT Docomo’s Docomo Hikari offering. Docomo has issued its own notice to customers.

Around 293,000 records cover former customers who cancelled in March 2026 or after. The company keeps those details for a while to handle final bills and support questions.

What was taken

Names, dates of birth, gender, phone numbers and email addresses.
Account user IDs and internet connection IDs.
About 54,000 email addresses together with their passwords, tied to four optional mail products (Mail Service (G), A-Box, So-net VAIO Mail and PostPet).
Bank account details (bank, branch, account type, number and holder name) in 16 records, according to SecurityWeek. So-net says it does not hold PINs for those accounts.

What was not

Credit card data. So-net says it does not store it.
Passwords for the standard free mailbox included with each subscription; So-net says it has found no sign those leaked.
NURO and the company’s other services, which do not appear to be affected.

Why the email passwords matter most

A name and birth date are useful to scammers. A working email password is useful immediately. In its FAQ, So-net acknowledged that anyone holding the stolen credentials could have read, sent and received mail from those accounts, which is why it reset them as an emergency step. Docomo, for its part, has cautioned customers about scam emails and look-alike sites posing as its d POINT Club loyalty program and a Universal Studios Japan ticket promotion, designed to harvest personal details. Neither company had confirmed any misuse of the data as of October 27. How the attacker got in has not been disclosed.

The breach lands in a difficult stretch for Japan. It follows the GMO Internet Group cloud desktop attack and other large incidents, and BleepingComputer reports that Japanese officials convened emergency meetings on Monday to coordinate a response.

What this means for your company

Two lessons travel well beyond Japan. First, data about former customers is still your data to protect. Keep a written retention schedule, delete what you no longer need and limit who can reach older records. Second, a breached password should be treated as a live key. If your business provides logins to customers, store passwords using strong one-way hashing, support multifactor sign-in and have a tested process for forcing resets quickly. And if any of your staff use personal or ISP email for work, now is a good time to move that work into managed accounts.

Want help deciding what customer data you really need to keep and how to lock down the logins that guard it? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.