Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information.

A Sony Group Corporation subsidiary, the company provides telecommunications and technology services, acting as an internet service provider (ISP) in Japan.

The breach occurred on October 19 and was detected four days later, when the company shut down the compromised servers and blocked external communication.

In an announcement yesterday, the company said that its So-net member database, supporting its internet access service, was accessed by an unauthorized party.

The investigation confirmed that a total of 2,585,481 customer records had been exposed, including the following types of information:

• Full names
• Phone numbers
• Email addresses
• User IDs
• Dates of birth
• Gender
• Internet Connection IDs

No banking, payment card, or other account details were exposed.

An additional 54,401 email addresses from several email services were also exposed along with account passwords. The company advises users to change their passwords.

In the breakdown of exposed records, Sony Network Communications says there are 2,141,986 So-net entries and 443,495 plala (S Course) records. The latter impacts another internet service provider, NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services.

NTT Docomo also notified customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan (USJ) campaign, falsely claiming that recipients had won and prompting them to enter personal information to claim tickets.

Docomo says the incident affects all current Hikari service clients and those who canceled within the preceding six months.

Sony reported the incident to Japan’s Personal Information Protection Commission and is investigating its cause and scope.

As of October 27, neither company had confirmed misuse of the exposed data in the wild.

Since the start of the year, multiple cyberattacks have targeted high-value companies and providers in Japan.

One of the most recent is the incident at GMO Internet Group and its Onamae Desktop Cloud service, which suffered a widespread malware attack on customer servers.

Telecommunications giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware.

Previously, NTT was hit in early 2025 by hackers who gained access to its systems and stole the data of 18,000 corporate customers.

The recent rate of data breaches is so unprecedented and threatening that the Japanese government held urgent meetings on Monday to plan its response.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report