Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original editorial illustration of a dark server room at night: one network cabinet stands open with warm amber light spilling out and a stream of small glowing data fragments drifting from it toward a neighbouring cabinet

Sony So-net Breach: 2.58 Million Records Exposed, What to Do

by

Sony So-net Breach: 2.58 Million Records Exposed, What to Do

In brief

  • Sony says hackers accessed its So-net member database on October 19, exposing 2,585,481 records — plus email passwords for 54,401 addresses.
  • The total splits into 2,141,986 So-net membership records and 443,495 plala (S Course) records, including former customers who cancelled from March 2026 onward.
  • Membership passwords were not leaked and no credit-card data was involved — but the separate email-password set is the real account-takeover risk, and those passwords were reset on October 27.
  • Sony says it has found no secondary harm so far, but warns that phishing messages exploiting the leaked details may arrive. Affected customers should reset passwords through the official So-net My Page portal, not through any emailed link.

Last verified: October 29, 2026.

What happened

Sony Network Communications, the Sony Group company behind the So-net internet service and NURO, disclosed on October 27, 2026 that an outside party gained unauthorized access to its So-net member database. The intrusion took place on October 19 and was discovered on October 23. Sony says it then shut down the affected server and blocked communications from the source of the access, and confirmed the next day that personal information had leaked.

The company has reported the incident to Japan’s Personal Information Protection Commission and says it is continuing to investigate the intrusion method and the full impact. As of October 27, it said it had not identified subsequent harm arising from the breach — a statement about what its investigation had found by that date, not a guarantee that nothing will follow. Its own warning points the other way: customers should expect suspicious communications that exploit the leaked information.

Two scope limits matter and are easy to lose in the headline. Sony says it has not identified leaks affecting NURO or services outside those specified in its disclosure. And there is no evidence that PlayStation Network was affected; this was the ISP member database, not the gaming network, even though both carry the Sony name.

One breach, three different risks

The 2.58 million figure is a total across three exposure sets that carry very different risks. Treating them as one number understates one risk and overstates another.

The largest set is the membership records: 2,141,986 So-net records and 443,495 plala (S Course) records, for a combined 2,585,481. The So-net figure includes 1,869,771 current members and 272,215 former members who cancelled from March 2026 onward. The plala figure includes 422,365 current members and 21,130 former members from the same period. Customers who cancelled by the end of February 2026 are not included in either set.

What those records contain is personal-identification data: names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Sony says passwords for these main membership accounts were not leaked, and no credit-card information was involved. That does not make the set harmless. Names, phone numbers, email addresses, dates of birth and connection IDs are exactly the ingredients of a convincing phishing message or an impersonation attempt — a message that knows your name, your provider, and roughly when you were a customer is far more persuasive than a generic one.

The second set is smaller and more urgent: email addresses and passwords for 54,401 addresses across four email services offered to So-net members. The largest group, 24,655 addresses, uses the free Mail Service (G); the rest belong to three paid services — the A-Box additional mailbox (17,672), So-net VAIO Mail (7,005), and the PostPet Mail Account Service (the remaining 5,069 by subtraction from the published total). Sony reset those email-service passwords on October 27 to prevent further harm, and affected users must set new ones through the official So-net My Page portal. Anyone who reused one of those passwords anywhere else has a second problem: the reset protects the So-net mailbox, not the other account that shares the same password.

The third set is tiny in number and the most sensitive per record: 16 bank account records containing the bank and branch name, account type, account number, and account holder name. Sony says it does not hold account PINs, and no plala customers are affected by this part of the leak. Sixteen records will not make headlines, but for those sixteen people the exposure is a direct financial-fraud risk, and they should be watching their accounts and talking to their bank rather than waiting for a phishing email.

A fourth, minor set rounds out the disclosure: data from seven password-reset notices issued to members was also exposed, and those passwords have been reset as well.

What affected customers should do now

If you are a current or former So-net or plala (S Course) customer, start from the assumption that your membership details are in the leaked set unless you cancelled by the end of February 2026. Sony says affected customers will be contacted individually and has set up a dedicated phone line and FAQ page, but do not wait for a message to act — and do not act on a message that asks you to click a link.

First, set a new password through the So-net My Page portal directly, by typing the address yourself or using a bookmark you already trust. If your So-net email password was among the 54,401 reset on October 27, this is not optional: the old password is compromised, and the reset only helps once you choose a new one. Second, change the same password anywhere else you reused it, starting with your main email account and any financial account. Third, treat unexpected emails, texts, and calls that reference So-net, your account, or your personal details with suspicion — verify through the official portal or phone line, never through a link or number in the message itself. Fourth, if you are among the small number with bank-account records exposed, contact your bank about added monitoring. Finally, keep an eye on your accounts for the next few months, not just this week: leaked identification data does not expire, and phishing built on it can arrive long after the disclosure fades from the news.

For readers who are not So-net customers, the lesson is narrower and worth taking seriously. An ISP holds the kind of data — name, phone, address, connection ID — that makes phishing personal, and it holds it for former customers too, in this case for anyone who cancelled from March 2026 onward. That retention window is the part of the story most people miss: leaving a service does not immediately remove you from its breach population. When you cancel any service, it is worth asking what data it keeps, for how long, and whether you can request deletion — before a breach answers the question for you.

What to watch next

Three follow-ups will determine how this story ends. The first is the intrusion method: Sony has not yet said how the attacker got into the member database, and whether it was a vulnerability, stolen credentials, or a third-party weakness. The second is whether any affected customer reports actual fraud or account takeover, which would convert Sony’s “no secondary damage confirmed” into a different picture. The third is the regulator’s response: the report to Japan’s Personal Information Protection Commission is the formal step, and any findings or orders that follow will say something about whether Sony’s retention of former-customer data and its detection timeline — four days from intrusion to discovery, four more to disclosure — met the expected standard.

This breach also lands in a month crowded with large record exposures, from university and healthcare databases to other ISP and platform incidents. The pattern that connects them is not a single attacker or technique. It is that member databases — the unglamorous systems holding names, emails, and account identifiers — keep proving to be the softest target with the longest tail of harm, because the data they hold stays useful to phishers long after the passwords are reset.

Related reading

  • University of Copenhagen breach: 525,000 records exposed — https://autechwire.com/university-of-copenhagen-data-breach-525000/
  • GMO Internet breach: customer data posted after Onamae intrusion — https://autechwire.com/gmo-internet-onamae-breach-customer-data-posted/
  • Capcom ID breach: 11.7 million accounts, what to do — https://autechwire.com/capcom-id-breach-11-7-million-what-to-do/

Sources

Related reading: Bandai Namco Breach: 346,247 Gundam Base Emails Leaked

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment