Sony Network Communications, which runs the Japanese internet service provider So-net, says hackers broke into So-net’s member database and leaked personal data from 2,585,481 member records across So-net and its plala service. For 54,401 email addresses, the mail passwords leaked too.
The company disclosed the breach on 27 October in a notice on the So-net site and a news release on its corporate site. It says the cause is “unauthorised access by a third party” and remains under investigation. The quotes here are TSN translations from Japanese.
What the company says happened
According to the notice, outsiders accessed the So-net member database on Monday 19 October. The company says it confirmed the access on Friday 23 October, then stopped the affected servers and cut off traffic from the source. By Saturday 24 October, it had established which data had leaked and how many records.
The company has not said who was behind the attack or how they got in.
Two kinds of leaked data
The figures fall into two separate groups, and the difference matters.
Member records. These cover 2,141,986 So-net records (1,869,771 current members and 272,215 former members who left from March 2026) and 443,495 records for plala’s “S course” (422,365 current and 21,130 former members). Those two totals add up to 2,585,481. The company’s question-and-answer page gives the figure as up to 2.586 million.
The leaked fields are name, phone number, email address, user ID, date of birth, gender and internet connection ID. The company says: “There was no leak of passwords” for these records. Members who left before the end of February 2026 are not affected.
Email addresses with passwords. Separately, the company says email addresses and their mail passwords leaked for 54,401 addresses on four mail services: Mail Service (G), 24,655; A-Box extra mailboxes, 17,672; So-net VAIO Mail, 7,005; and PostPet mail accounts, 5,069.
This is the more serious leak. The company’s FAQ says the leaked passwords left a third party able to read, send and receive mail on those accounts. It reset the passwords on 27 October, and affected users need to set new ones through So-net’s My Page. The FAQ says the free basic So-net mailbox is not affected.
The notice lists two smaller leaks: 16 sets of bank account details (So-net only; none for plala) and 7 records of password-reset notices, whose passwords have been reset. The company says no credit card data was involved, and its FAQ says it holds none. It has found no leak from other services, including the NURO broadband brand.
Why the mail passwords matter most
A leaked name, birth date and phone number is bad news, but a working email password is worse. Email is often the key to everything else: password-reset links for other accounts arrive there, so anyone who can read the inbox may be able to take over shopping, banking or social media accounts too.
So-net’s response suggests it sees that risk. It reset the 54,401 passwords itself, without warning users first. Its FAQ explains the reason: anyone holding the data could already use those mailboxes. That closes the door for the future, but the company has not said whether anyone logged in to those mailboxes between 19 October and the reset on 27 October.
The member records carry a different risk. Names, phone numbers and email addresses together make convincing scam messages easy to write. So-net warns that fraudsters may contact members using the leaked details, and advises them to ignore suspicious emails, texts and calls, and not to open links or attachments in them.
The breach adds to a run of Japanese company leaks, which TSN has tracked in its round-up of Japan’s data-breach wave. In another Japanese case, GMO says it refused a $50 million extortion demand after a hack of its desktop cloud service. So-net has not mentioned any ransom demand. Attack tools are changing too: in South Korea, an open-source AI hacking tool was used against banks, according to CrowdStrike. So-net has not said what tools were used against it.
What happens next
The company has reported the breach to Japan’s Personal Information Protection Commission and says it is investigating the cause and full scope. It says no secondary harm had been confirmed as of 27 October. It plans to contact affected customers individually, and has set up a special helpline. It will post further findings as news releases.
Sources
- So-net: notice of information leak following unauthorised access to the So-net member database (27 October 2026, Japanese)
- Sony Network Communications: news release on the same incident (27 October 2026, Japanese, PDF)
- So-net: questions and answers on the incident (Japanese)
Related stories
- Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
- GMO Says It Refused a $50m Extortion Demand After Desktop Cloud Hack
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
