Sony's So-net and plala breach exposes about 2.58 million subscriber records in Japan

On 27 October 2026, Sony Network Communications — the Sony Group subsidiary that runs the So-net and plala consumer internet services in Japan — disclosed that an unauthorized party had reached the membership database behind those services. The company said the intrusion exposed more than 2.58 million subscriber records, split between about 2,141,986 So-net members and 443,495 plala (S Course) members. The totals include current subscribers as well as former customers who had cancelled their service from March 2026 onward.

The exposed records contained names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Sony said the breach also exposed the passwords for 54,401 email accounts across its Mail Service, A-Box, So-net VAIO Mail, and PostPet mail offerings, and the bank-account details — institution, branch, account type, number, and holder name — of 16 customers. The company said that membership-login passwords, bank PINs, and credit-card information were not among the exposed data, and that customers of its NURO fibre service and PlayStation Network accounts were not affected.

Detection and response

Sony Network Communications said the unauthorized access occurred on 19 October and was detected on 23 October, after which it shut down the affected server and blocked communications from the source. On disclosing the breach it reset the passwords for the compromised email accounts, requiring affected customers to set new ones through the official So-net portal, and reported the incident to Japan's Personal Information Protection Commission. The company said it had not identified any subsequent misuse of the data but warned that the exposed information could fuel phishing and other fraudulent contact, urging subscribers to treat unexpected emails, texts, and calls with caution.

Why it matters

The breach lands amid a run of major cyber incidents in Japan, where internet providers and large consumer brands have faced a steady stream of intrusions through October 2026. Subscriber databases of this size are prized by attackers because they bundle identity details, contact information, and — in this case — a pool of live email credentials that can be used directly or sold on. Sony had not named a threat actor or explained how the intruder gained access at the time of disclosure, and said its investigation into the cause was continuing. With the affected server taken offline and the source cut off, the incident's status is contained while that work proceeds.