The Sony Network Communications data breach is an unauthorised access incident disclosed on 27 October 2026 that exposed 2,585,481 So-net and plala membership records in Japan. Sony Network Communications is a Sony Group company providing consumer internet services in Japan under So-net and plala, and the disclosure concerned its So-net membership database. The access occurred on 19 October 2026, discovery followed on 23 October 2026, and the company published the disclosure on 27 October 2026 after investigation confirmed a leak on 24 October 2026. The membership records contained names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs, and a subset of 54,401 records within that population also contained email service passwords. Membership passwords were not leaked, according to the company notice, while email service passwords were leaked for the 54,401 addresses, and the company initialised those passwords on 27 October 2026.
Incident chronology
On 19 October 2026, an external party gained unauthorised access to the So-net membership database, and on 23 October 2026 the company confirmed that the access had occurred, stopped the affected server, and blocked communications from the source of the access. On 24 October 2026, investigation confirmed that personal information had leaked and identified the data categories and the record counts set out in the disclosure. On 27 October 2026, the company published the disclosure, initialised the exposed email service passwords, and reported the incident to Japan's Personal Information Protection Commission. The dates and the counts in this article come from the primary company notice.
Four days passed between the access on 19 October 2026 and the discovery on 23 October 2026, and a further four days passed between discovery and public disclosure on 27 October 2026. The notice does not state when any particular record was copied, and the cause is described in the notice only as unauthorised access by a third party, under investigation, with no intrusion method stated in the sources read for this article.
Records in the disclosure
The total of 2,585,481 records is the sum of two membership datasets. The So-net membership dataset contains 2,141,986 records, comprising 1,869,771 current members and 272,215 former members who cancelled from March 2026 onward. The plala (S Course) membership dataset contains 443,495 records, comprising 422,365 current members and 21,130 former members who cancelled from March 2026 onward. The arithmetic checks: 2,141,986 plus 443,495 equals 2,585,481, with a combined current member total of 2,292,136 and a combined former member total of 293,345.
| Dataset | Records | Current members | Former members from March 2026 onward |
|---|---|---|---|
| So-net membership records | 2,141,986 | 1,869,771 | 272,215 |
| plala (S Course) membership records | 443,495 | 422,365 | 21,130 |
| Total membership records | 2,585,481 | 2,292,136 | 293,345 |
The email password figures form a subset inside that population. The company notice lists 54,401 email addresses with passwords for customers using four specific services, and the four service counts sum to 54,401. CyberInsider states explicitly that those 54,401 addresses belong to current or former So-net members in the affected population, so the figure is not an additional 54,401 records on top of 2,585,481. A second distinction sits alongside the subset point: passwords for the membership records themselves were not leaked for either dataset, while passwords for the four email services below were leaked for the 54,401 addresses.
The 54,401 email addresses with passwords are a subset inside the 2,585,481 membership records, not an additional total.
| Email service | Addresses with passwords |
|---|---|
| Mail Service (G) | 24,655 |
| A-Box additional mailboxes | 17,672 |
| So-net VAIO Mail | 7,005 |
| PostPet Mail Account Service | 5,069 |
| Total email addresses with passwords | 54,401 |
Two smaller datasets sit inside the same disclosure, and both are subsets rather than additional totals. The company confirmed 16 bank account records, containing financial institution names and codes, branch names and numbers, account types, account numbers, and account holder names. The company states that bank account PINs are not held by the company, so PINs were not part of the leak, and that plala (S Course) members had no bank information leak in this incident. The company also confirmed 7 member notification records for password reset notices, with the passwords concerned initialised. The notice states that no credit card information was included in any of the five disclosed categories.
Scope limits
The notice states that no information leak was confirmed for services other than those listed, including NURO, the high speed fibre service in the same group. That statement describes what the investigation had confirmed by 27 October 2026. The former member cutoff works in the same dated way: former members who cancelled from March 2026 onward are inside the membership and email datasets, while former members who had cancelled by the end of February 2026 are outside those datasets. The totals count records, not distinct people, because a person can appear in more than one category and the email dataset overlaps the membership population.
The PlayStation Network scope point is hedged, because the primary notice does not name PlayStation Network in the text read for this article. The primary notice states only that no leak was confirmed for services other than those listed, including NURO. Beebom reports that the breach did not affect PlayStation Network accounts, so that point rests on secondary reporting rather than on a direct statement in the primary notice. The notice does not state how the compromised email passwords were stored, and CyberInsider reporting states that Sony has not disclosed the storage method, so this article claims no storage method for those passwords.
Containment and notification actions
After discovery on 23 October 2026, the company stopped the affected server and blocked communications from the source of the unauthorised access, and on 27 October 2026 the company initialised the passwords for the 54,401 email addresses listed in the notice. Affected customers in that group set new passwords through the official So-net My Page portal, reached through the official So-net site rather than through a link in a message. The company stated that affected customers would be contacted individually, and the company reported the incident to Japan's Personal Information Protection Commission.
The company customer guidance in the notice is specific, and it covers mail, SMS, and telephone contacts about the incident. Affected customers were asked not to respond to such contacts, not to open links in message bodies, and not to open attached files. That guidance applies even when a message uses correct personal details.
Password, contact, and account checks for affected customers
On 27 October 2026, affected customers in the email password group reset the affected email password through the So-net My Page portal, accessed directly. Affected customers who used the same password on another service changed that password there as well, because the exposed password became a known value for credential reuse attempts. The guide on whether changing a password stops further access states the limit of that measure: a password change stops access through that password, but it does not withdraw personal details already copied from the membership file.
Affected customers treated unexpected mail, SMS, and telephone contacts about the incident with caution, including contacts that quoted correct personal details. A contact that read back a real name, user ID, or date of birth proved possession of leaked data, not legitimacy of the sender. Affected customers verified any claim about the incident through a channel already known to them, rather than through a number or link supplied in the suspicious message. The guide to how leaked email addresses are used for phishing describes that mechanism in general terms.
Affected customers checked whether an email address appeared in a known breach dataset, through a breach search service such as Have I Been Pwned, and affected customers in the bank record group contacted the relevant financial institution through a known channel if any unexpected transaction concerned the account named in the notice. The bank group is small, at 16 records, but account numbers were included for that group, so direct contact with the institution is the response described for that group.
AliasFleet provides one email alias per service, forwarding to a single destination inbox, so a leak from one service exposes only the alias given to that service. That mechanism does not change the name, phone number, date of birth, or bank details already in the Sony file, and it does not undo the exposure of the 54,401 email passwords. An alias controls the email channel in future leaks, but it does not protect the identity fields that dominate the Sony membership file.
A So-net address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Investigation status
The investigation remained open as of the 27 October 2026 disclosure, and the notice listed the cause as unauthorised access by a third party, under investigation. No intrusion method, vulnerability, attacker identity, or tool has been stated in the sources read for this article, and no statement in those sources claims that the dataset was published publicly or sold. No source read for this article states a ransom demand or a dwell time before 19 October 2026, so this article states neither point.
As of 27 October 2026, the company stated that, within the scope of what it then knew, no secondary harm arising from the breach had been identified. That statement is dated and limited, and the same notice warned that suspicious communications using the leaked information may arrive in future. Both parts stay together: no secondary harm identified by that date, and a warning that impersonation attempts remain possible. Whether the leaked data has been misused after that date is unknown from the sources read, because the company position covers only what had been identified by then.
The figures in this article are the figures confirmed in the 27 October 2026 notice: 2,585,481 membership records, 54,401 email addresses with passwords inside the affected population, 16 bank account records, and 7 member notification records. If the continuing investigation revises any figure, or identifies a further dataset, the revised figure will replace the figure in this article, and the revision will be dated to the later notice.
Top comments (0)