Unauthorized external access to the membership database of Sony Group internet service provider So-net exposed more than 2.58 million personal information records belonging to current and former members. The affected data also includes 440,000 records for Docomo Hikari users whose service it operated under contract.
Key points
- What happened: Unauthorized access to So-net's membership database exposed more than 2.58 million personal information records, including 54,401 email passwords.
- Who is affected: Alongside current and former So-net members, 443,495 records for Docomo Hikari plala (S Course) users were exposed. Those who canceled by the end of February 2026 are excluded.
- What to do: Affected email service users' passwords have been forcibly reset and need to be set again through So-net My Page. Do not open links in suspicious emails impersonating So-net or Docomo.
- Why it is serious: Attacks on communications infrastructure at GMO, KDDI, and IDC Frontier have continued in 2026, prompting an emergency ministerial meeting.
Four days between intrusion and detection
The unauthorized access occurred on October 19. Sony Network Communications detected the anomaly four days later, on October 23, immediately shutting down the affected server and blocking communication with the source of the intrusion. Its investigation confirmed the personal information leak the following day, October 24. The company disclosed it on October 27.
The cause has been described only as unauthorized access by a third party. The entry path and techniques remain under investigation. The company has reported the incident to Japan's Personal Information Protection Commission.
What information was exposed?
The number of exposed So-net membership records is 2,141,986: 1,869,771 current members and 272,215 former members who canceled from March 2026 onward. The information includes names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Membership account passwords were not exposed.
A serious aspect is that email addresses and their passwords were exposed for some email services. Four services account for 54,401 records: Email Service (G), 24,655; A-Box additional mailboxes, 17,672; So-net VAIO Mail, 7,005; and PostPet Mail Account Service, 5,069. Exposed email passwords can enable impersonation emails or account takeovers on other services where the same password is reused.
I confirmed that Sony Network Communications forcibly reset affected email service passwords on October 27. Users need to set new passwords through So-net My Page.
In addition, 16 bank account records, including financial institution, branch, account number, and account holder, and seven member notification records used for password resets were exposed. Credit card information was not included. The company says it has not confirmed leaks from other services such as NURO.
People who canceled by the end of February 2026 are outside the affected group.
Docomo Hikari also affected, alongside phishing attempts
NTT Docomo announced the same day that 443,495 records for Docomo Hikari's plala (S Course) service had leaked. The information was stored in the same database because service operation was outsourced to Sony Network Communications.
Affected customers include active users and those who canceled within the previous six months. The exposed fields are personal information similar to So-net membership data, excluding passwords, credit card information, and bank account details. NTT Docomo says information for customers outside plala (S Course), including plala (Docomo Hikari) and Plala Hikari Mate with FLET'S, was not leaked.
Docomo also warned the same day about phishing emails impersonating d POINT CLUB. Claiming recipients had won a USJ promotion, they directed users to a fake ticket-issuing site and requested personal information. Docomo explicitly said it was not running such a promotion. Emails posing as official messages immediately after a leak can use exposed personal information to appear credible. Not opening links in unfamiliar emails is the surest defense.
A dedicated inquiry line is available for Docomo Hikari plala (S Course) users at 0120-035-700, open 10:00 a.m.–7:00 p.m., including weekends and holidays.
Attacks on Japan's communications infrastructure continue
Cyberattacks on Japanese communications and IT infrastructure have continued at an unusual pace in 2026. GMO Internet Group's Onamae.com Desktop Cloud was attacked (in Japanese), KDDI reportedly suffered a leak affecting around 12 million people, and IDC Frontier was hit by ransomware. In 2025, an intrusion into NTT systems exposed data on 18,000 corporate customers.
As of October 27, no misuse of the data in this leak had been confirmed. However, the combination of names, phone numbers, dates of birth, and email addresses provides ample material for phishing and bypassing identity checks.
In response to the situation's severity, Prime Minister Sanae Takaichi held a meeting of relevant ministers on cybersecurity on October 26. She said repeated cyberattacks against Japanese companies and other organizations had caused numerous major information leaks, describing the situation as serious and requiring urgent reinforcement of countermeasures. She cited simulated attack testing using advanced AI and a cyberattack monitoring network covering small and midsize businesses. That the government has reached the point of convening an emergency meeting itself reflects the current state of Japan's cyber defenses.
Originally published on Joho no Todai. The Japanese original is here.
Top comments (0)