Sony Network Communications said on October 27 that unauthorized access to the member database of its So-net internet service exposed information on about 2.59 million people, including former members who have already closed their accounts.
The company said the breach also exposed email addresses and passwords for about 54,000 accounts on some of its email services. It reset those passwords the same day and is asking users to set new ones.
The exposed records total 2,585,481. They break down into 2,141,986 for So-net members and 443,495 for plala (S Course), an internet connection service for NTT Docomo's Docomo Hikari fiber line that carries over So-net connection settings. The data includes names, phone numbers, email addresses, dates of birth, gender, user IDs and internet connection IDs.
The affected group covers current members and people who closed their accounts on or after March 2026. The company said it has found no leak of member-account passwords or credit card details.
Which email services were hit
The email addresses and passwords, 54,401 in all, came from four services: Mail Service (G), for former users of the GyaO video platform; A-Box, which lets users add extra mailboxes; So-net VAIO Mail, which provides addresses on a VAIO domain; and the PostPet Mail Account Service, which offers addresses using the PostPet name.
Separately, bank account details for 16 people were exposed — institution name, bank code, branch name and code, account type, account number and account holder — along with seven password-reset notices. Bank PINs were not included.
The company said it has found no leak in its other services, including the NURO Hikari fiber line.
Four days to confirmation
The unauthorized access occurred on October 19, and the company confirmed it on October 23. It shut down the affected servers and cut off traffic from the source of the intrusion, and the leak itself was established on October 24 during the investigation that followed.
Sony Network Communications has reported the breach to the Personal Information Protection Commission — the government body that oversees handling of personal data — and is still investigating the cause and the full scope.
The company said it has confirmed no secondary harm so far, but warned users that the stolen data could be used to send fraudulent emails and SMS messages.
The breach follows a string of similar incidents at Japanese companies, including Joshin, the electronics retailer, which reported unauthorized access affecting as many as 6.23 million records, and the figure maker Good Smile Company, which shut its official online store after an intrusion.