Sony Network Communications, a subsidiary of Sony Group Corporation, has disclosed a cybersecurity incident affecting more than 2.5 million customer records in Japan. The breach exposed personal information belonging to current and former users of its internet services, along with passwords associated with tens of thousands of email accounts.
The intrusion occurred on October 19, 2026, but remained undetected until October 23. After discovering unauthorized access to its So-net membership database, the company disconnected the affected servers from external networks to prevent further access.
An investigation determined that 2,585,481 customer records had been compromised. The exposed information included names, telephone numbers, email addresses, dates of birth, gender, user IDs and internet connection identifiers. Sony stated that banking information, payment card details and other account information were not included in the affected customer records.
However, a separate set of 54,401 email addresses and associated passwords was also exposed. The company has advised users of the affected email services to change their passwords.
The breach extends beyond Sony’s own So-net subscribers. Of the affected customer records, 2,141,986 belonged to So-net, while another 443,495 were associated with the plala S Course service. The latter is connected to NTT Docomo, which relies on Sony Network Communications to support certain Docomo Hikari internet services.
NTT Docomo has issued its own notification, confirming that the incident affects current customers of the relevant Hikari service and those who canceled within the previous six months.
The company also warned customers about phishing campaigns impersonating its d POINT Club loyalty program and a Universal Studios Japan promotion. These fraudulent messages direct recipients to websites claiming they have won prizes and attempt to collect personal information. No connection between these scams and the stolen records has been established.
Sony has reported the incident to Japan’s Personal Information Protection Commission and continues investigating how the attackers gained access. As of October 27, neither Sony nor NTT Docomo had confirmed that the compromised information had been misused.