Sony Network Communications has confirmed that attackers accessed its So-net customer database, exposing more than 2.58 million records belonging to current and former internet subscribers in Japan. The incident also compromised passwords for over 54,000 email accounts and banking information associated with a small number of customers.
The unauthorized access occurred on October 19, 2026, but was not discovered until October 23. After identifying the intrusion, the company shut down the affected server and blocked external connections. An investigation confirmed the exposure of personal information the following day.
The largest portion of the breach involved 2,141,986 So-net customer records, including 1,869,771 active subscribers and 272,215 former customers who had canceled their services since March 2026. The compromised information included names, telephone numbers, email addresses, dates of birth, genders, user IDs, and internet connection identifiers.
Another 443,495 records belonged to customers of the plala S Course internet service. This included 422,365 active members and 21,130 former subscribers. The exposed information was similar to that found in the So-net records, but the company confirmed that passwords associated with these customer accounts were not compromised.
A separate exposure affected 54,401 email accounts across four older So-net services. The largest group involved 24,655 Mail Service G accounts, followed by 17,672 A-Box accounts, 7,005 So-net VAIO Mail accounts and 5,069 PostPet Mail accounts. Both email addresses and their corresponding passwords were exposed.
Sony Network Communications reset the affected email passwords on October 27. Customers using these services must establish new passwords before regaining access to their mailboxes. The company’s standard So-net email service was not affected by the password exposure.
Investigators also identified the disclosure of banking information belonging to 16 customers. These records contained financial institution names, branch details, account numbers, and account holder names. Banking PINs were not exposed because the company does not store them.
Additionally, seven password-reset notification records were compromised. The associated passwords have been reset, and the affected customers are being contacted individually.
The company confirmed that no credit card information was exposed. Other services, including its NURO internet brand, were not affected.
Sony Network Communications has reported the incident to Japan’s Personal Information Protection Commission and continues investigating how the attackers accessed its systems. As of October 27, the company had not identified any confirmed secondary damage resulting from the breach, but warned customers about suspicious emails, text messages, and telephone calls that could exploit the stolen information.