Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

Hackers have stolen the personal information of current and former So-net and Plala internet subscribers in Japan, Sony Network Communications announced on October 27. Nearly 2.6 million records were impacted.

The attackers broke into the So-net member database on October 19. The company first spotted the intrusion on October 23, then took the targeted server offline and cut off traffic coming from the attackers.

By the following day, its investigators had confirmed that personal data had been taken and determined the scope of the leak.

The stolen information includes names, dates of birth, gender, phone numbers, email addresses, user IDs, and the IDs customers use to connect to the internet.

Of the roughly 2.6 million exposed records, 2.14 million belong to So-net subscribers and 443,000 to Plala (S Course) subscribers. Roughly 293,000 of them relate to people who left the services in March 2026 or later, as their details are kept for some time to handle final bills and support requests.

The hackers also obtained approximately 54,000 email addresses, along with their passwords, belonging to four additional mail services: Mail Service (G), A-Box, So-net VAIO Mail, and the PostPet email account service. So-net has not identified any password leak for the free basic mailbox that comes with a subscription.

Advertisement. Scroll to continue reading.

On October 27, the company began resetting the passwords for the impacted email addresses, forcing users to set new ones before they could resume using the services.

“Due to the leak of email addresses and email address passwords, a third party who obtained the information was in a position to view, send, and receive emails using email software and So-net Webmail. We implemented these measures as an emergency step to prevent unauthorized use of customers’ email addresses,” reads a translation of an FAQ issued by So-net. 

The breach also impacted 16 records containing bank account details, such as the bank and branch, account type, account number, and account holder’s name. So-net says it does not hold the PINs for these accounts.

Credit card data is not involved, because So-net does not store it. NURO and the company’s other offerings do not appear to be affected.

How the attackers got in has not been disclosed. So-net lists the cause as unauthorized access by a third party and says it is still investigating. The incident has been reported to Japan’s Personal Information Protection Commission.

Related: Hackers Steal 1.8 Million Records From Nikkei

Related: 240,000 Hit by Data Breach at Japan’s Digital Agency

Related: Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei