Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

What it is

Sony Network Communications announced on 27 October 2026 that attackers broke into the So-net member database on 19 October and took nearly 2.6 million records. The company detected the intrusion on 23 October, took the targeted server offline and blocked the attacker traffic. By 24 October it had confirmed data theft and the scope of the leak.

Preconditions / Affected

• Split: 2.14 million records belong to So-net subscribers and 443,000 to Plala (S Course) subscribers. About 293,000 relate to people who left the services in March 2026 or later, because their details are retained for final billing and support.
• Profile data: names, dates of birth, gender, phone numbers, email addresses, user IDs, and the IDs customers use to connect to the internet.
• Mail credentials: about 54,000 email addresses with passwords, from four mail services: Mail Service (G), A-Box, So-net VAIO Mail and the PostPet email account service. So-net has not identified a password leak for the free basic mailbox that comes with a subscription.
• Bank data: 16 records with bank, branch, account type, account number and holder name. So-net says it holds no PINs for these accounts.
• Not affected: credit card data (not stored) and, apparently, NURO and the company's other offerings.

What to do

• Mail users: So-net began forced password resets for the affected addresses on 27 October. Users must set a new password before they can use the mail services again.
• Why the reset matters: with the leaked credentials, a third party could read, send and receive mail through email software and So-net Webmail.
• Reuse: the page does not address password reuse on other sites. Anyone who used a leaked mail password elsewhere has to judge that risk themselves.
• Bank-record holders: the page gives no specific guidance.

Caveats

• Entry method: So-net lists the cause only as unauthorized access by a third party and says its investigation continues. No vulnerability, malware or actor is named.
• Reporting: the incident was reported to Japan's Personal Information Protection Commission.