Short answer
Sony Network Communications said an unauthorized third party accessed the So-net member database on 19 October 2026. About 2.58 million member records were exposed, and passwords for 54,401 email accounts were taken. The company has reset those passwords and reported the breach to Japan's privacy regulator.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Sony Network Communications (So-net) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Internet service provider |
| Country | Japan |
| Detected | 2026-10-19 |
| Disclosed | 2026-10-27 |
| People or records affected | About 2.58 million current and former members (2,141,986 So-net and 443,495 plala records), plus 54,401 email accounts with passwords |
What data was exposed
- Full names
- Phone numbers
- Email addresses
- User IDs
- Dates of birth
- Gender
- Internet connection IDs
- Email account passwords for 54,401 addresses (since reset)
What happened
Sony Network Communications, the Sony group’s internet provider unit, told customers on 27 October 2026 that an unauthorized party had reached its So-net member database. Per Help Net Security, the intrusion happened on 19 October, the company confirmed it on 23 October, and its investigation finished the next day.
The exposed records cover about 2.58 million people. BleepingComputer counts 2,585,481 records, made up of 2,141,986 So-net entries and 443,495 plala (S Course) entries. The plala service is connected to NTT Docomo’s Hikari line.
Who is affected
Both current and former members are included. Help Net Security says 272,215 So-net records belong to people who left in March 2026 or later, and 21,130 plala records belong to former members. People who cancelled by the end of February 2026 are not affected.
Separately, 54,401 email addresses were exposed together with their passwords. Help Net Security says 24,655 of them are on the free Mail Service (G) and the rest on other mail services. The company has reset those passwords, and affected users must set new ones through My Page.
Where sources disagree
Help Net Security reports 16 bank account records, including bank name, branch, account type, account number and holder name, along with data from seven password-reset notices. BleepingComputer says no banking or payment card details were exposed. Both agree that credit card numbers were not part of the breach. We could not open Sony’s own notice, so treat the bank detail as unresolved and check your statements.
What the company said
Sony Network Communications said it reported the incident to Japan’s Personal Information Protection Commission and is still investigating how the attacker got in. As of 27 October it had not confirmed misuse of the data. It advised people to ignore suspicious emails, texts and calls that use the leaked details.
Why the scam risk is higher than usual
Names, phone numbers, birth dates and user IDs together are what a scammer needs to sound convincing. A message that quotes your user ID is not proof that it comes from So-net. Read our guide to phishing messages, and see urgent payment scams if a caller pressures you to pay. The data breach checklist lists steps in order. Browse more breach reports or our editorial policy.
What is still unknown
The cause of the intrusion has not been published. The bank data conflict remains open, and the investigation continues.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and texts that quote your real name, phone number or So-net user ID to look authentic.
- Fake So-net or plala notices asking you to log in to 'confirm' your account or reset a password through a link.
- Phone calls using your date of birth and address details to pass as your provider or a bank.
- Credential stuffing: attackers trying your leaked email password on other sites if you reused it.
What to do if you are affected
- 01Set a new password through the official So-net My Page portal, typing the address yourself rather than using any link in a message.
- 02If you used the same password on any other account, change it there too and turn on two-factor authentication.
- 03Treat any email, text or call that mentions your So-net details as suspect. Do not open links or attachments in it.
- 04Wait for the individual notification from Sony Network Communications, and use the company's dedicated phone line or FAQ page if you have questions.
- 05Review bank and card statements for unfamiliar activity. Sources disagree on whether any bank details were included, so check to be safe.
Frequently asked questions
Was my data in the So-net breach?
You may be affected if you were a So-net or plala (S Course) member, or left in March 2026 or later. Customers who cancelled by the end of February 2026 are not affected, according to Help Net Security. Sony says it will notify people individually.
Were PlayStation accounts affected by the So-net breach?
Reports describe the breach as limited to the So-net member database. We found no confirmation that PlayStation Network accounts were part of it.
Were passwords or bank details leaked?
Sony said email passwords for 54,401 accounts were exposed and have been reset. Help Net Security reports 16 bank account records were included, while BleepingComputer says no banking details were exposed. Sources conflict, so watch your statements.
Is So-net safe to use now?
The company says it has investigated and reported the breach to Japan's Personal Information Protection Commission. Its inquiry is ongoing. Reset your password and be careful with any message about your account.
Has the stolen data been misused?
As of 27 October, Sony and NTT Docomo had not confirmed any secondary damage, but they warned the data could be used for suspicious messages.
Sources
- Data breach at Sony-owned internet provider compromises 2.6 million customer records, Help Net Security, 2026-10-28
- Sony ISP subsidiary data breach exposes 2.5 million customer records, BleepingComputer, 2026-10-28
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.