1950s pulp illustration of a chrome robot shielding a tower of glowing punch-cards beside a cracked undersea cable and brass padlock under a red beacon, navy teal on aged paper, no text

So-net breach: 2.58M records and Japan’s APPI clock

Home » Breaches & Incidents » So-net breach: 2.58M records and Japan’s APPI clock

Sony Network Communications has confirmed unauthorised access to the So-net member database. The primary notice puts exposed records at about 2.58 million across So-net and NTT Docomo plala (S Course) customers, with tens of thousands of email passwords reset. Japan’s APPI reporting clock to the Personal Information Protection Commission is already running.

What Sony Network Communications confirmed

In its 27 October 2026 notice (opens in a new tab), Sony Network Communications (Sony Group) said external unauthorised access hit the So-net member database on 19 October 2026, was confirmed on 23 October, and led to server shutdown and blocking of the attacker’s traffic the same day. By 24 October the company had mapped the leaked fields and counts. BleepingComputer (opens in a new tab) summarised the incident for an English-language audience on 28 October; the figures below follow the Japanese primary notice.

So-net member data: 2,141,986 records (1,869,771 current members; 272,215 former members who left on or after March 2026). Fields: name, phone number, email address, user ID, date of birth, gender, and internet-connection ID. Account passwords for the member service were not leaked.

Email addresses and email passwords: 54,401 addresses across named mail services (Mail Service (G) 24,655; A-Box 17,672; VAIO Mail 7,005; PostPet 5,069). The company reset those email passwords on 27 October 2026 and told affected customers to reset again via My Page.

plala (S Course): 443,495 records (422,365 current; 21,130 former from March 2026 onward), same identity fields as So-net members, again without member-service passwords. plala is an NTT Docomo Hikari-related service for which Sony Network Communications holds data. Combined So-net plus plala identity records: 2,585,481.

The notice also records 16 bank-account records leaked (institution, branch, account type, number and name — no PIN; none for plala) and 7 password-reset notification-letter records. Credit-card data was not included. BleepingComputer’s English summary said no banking or payment details were exposed; that conflicts with the Japanese primary, which we follow here. NURO and other services outside the listed sets showed no confirmed leak. Cause: third-party unauthorised access, still under investigation. As of 27 October the company said it had seen no secondary damage from the incident in the scope it then understood.

APPI Article 26: the PPC clock

Japan’s Act on the Protection of Personal Information (APPI) Article 26, read with the Enforcement Rules and the Personal Information Protection Commission’s leak-response guidance (opens in a new tab), requires a two-stage report to the PPC when a reportable incident occurs. Unauthorised access for a wrongful purpose, and leaks affecting more than 1,000 people, both qualify. The preliminary report (速報) is due promptly after awareness — the PPC’s published guide puts that at roughly 3 to 5 days. The final report (確報) is due within 30 days of awareness, or within 60 days where the incident appears to have been carried out for a wrongful purpose, including cyber attacks. Affected individuals must also be notified; where individual notice is impracticable, alternative protective measures such as public disclosure and an inquiry desk are required.

Sony Network Communications states in the primary notice that it has reported the matter to the Personal Information Protection Commission and is continuing its investigation of cause and scope. It has opened a dedicated customer FAQ and a special dial-in (0120-36-8887). That puts the PPC preliminary report, on the company’s own account, inside the prompt window after the 23–24 October confirmation of the leak.

Phishing follow-on: what customers should do

Names, phone numbers, email addresses, user IDs and dates of birth are enough to script convincing ISP and “Docomo Hikari” phishing. BleepingComputer notes that NTT Docomo has already warned customers about fake d POINT Club and Universal Studios Japan campaign messages. Sony’s own advice matches the standard playbook: do not reply to unexpected email, SMS or calls; do not open links or attachments in those messages; reset the affected email passwords via the real My Page URL you type yourself.

  • If you used one of the listed So-net mail services, complete the password reset on My Page (opens in a new tab) and treat any earlier password as burned.
  • Watch for messages that quote your So-net or plala user ID, connection ID or partial phone number.
  • The 16 customers with bank details in scope should treat any payment or “re-verify account” contact as hostile until confirmed out of band with their bank.
  • Do not use phone numbers or links embedded in unexpected breach notices; use the published FAQ and dial-in on so-net.ne.jp.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)