So-net and plala Breach: 2.58 Million Member Records Leaked

Tue Oct 27

October 27, 2026: Sony Network Communications said an intruder accessed the member database behind So-net and plala, and that 2,585,481 records leaked. The company's notice describes names, phone numbers, email addresses, user IDs and dates of birth, and says the passwords for 54,401 email-service addresses were also exposed. Canonical: sony-so-net-plala2026. Primary source: So-net's October 27 notice (Japanese).

So-net is one of Japan's longest-running internet providers, and plala's S Course members sit in the same member database. One breach therefore reaches two brands and more than two million people. The headline notice is published on So-net's own site. The detailed figures below come from Japanese press coverage of that notice, and we say so where it matters.

What happened

October 19: the unauthorised access took place, according to the company's account.
October 23: Sony Network Communications detected it, shut down the affected server and blocked the attacker's connections.
October 24: an investigation identified that personal information had leaked.
October 27: the company published its notice, reset the passwords for the affected email services and reported the incident to Japan's Personal Information Protection Commission.

Outlets give slightly different dates for when the leak was identified. The timeline above follows the company's account as it was reported.

Technical analysis

The company describes the cause only as unauthorised access by a third party, and says the investigation is still open. It has not said how the attacker got in. The notice does make one thing clear: the attacker reached a database that holds identity and contact details. Those fields are enough to write a convincing phishing message, even without passwords.

Impact

The 2,585,481 records break down into 2,141,986 So-net records and 443,495 plala S Course records. The total includes current members and people who left after February 2026. Cancelling an account did not remove anyone from the database.

Exposed fields include names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs. The company also found 16 bank-account records showing financial institution names and account numbers, with no PINs, and seven password-reset notice records. Sony says no credit-card data was involved.

Verified vs unverified

Verified (company notice): the intrusion, detection on October 23, the server shutdown, the report to the regulator, and the reset of passwords for the affected email services.
Verified (company figures, as reported by Japanese press): the 2,585,481 total, the field list, and the 54,401 email-service addresses.
Not confirmed: how the attacker got in, whether the data has been sold or published, and whether any member has suffered fraud. The company had not confirmed any secondary harm when it published.

The company reports that member passwords were not leaked. That is its current position, and the investigation is still open.

What to do

Check whether you are affected. Use the individual notice, the question-and-answer page or the contact desk that the company names. Do not use a link in an unexpected email to do it.
Change the password on any affected email-service address and set it through the account's My Page, not through a link in a message.
Treat unexpected contact as suspicious. A scammer can quote your name, date of birth or bank. If a caller claims to be from So-net or plala, hang up and call the number printed on your own bill or the company's official site.
Check your bank statements if a bank account is linked to a So-net or plala service, since 16 bank-account records were affected.
Turn on two-factor authentication where it is offered, especially for your email account, which is the recovery route for most other accounts.

Why the leaked fields matter

Names, phone numbers and email addresses are the core of a phishing message: they let a criminal address a real customer and name the provider they use. Dates of birth and gender add a second layer, because banks and online services often use them as checks. User IDs and connection IDs help link a leaked record to a specific account. None of those fields is a password, but together they make a message from "your provider" look routine.

The 54,401 email-service addresses are a different category. Sony reset those passwords on October 27, which removes the immediate risk for those accounts. Anyone who used the same password elsewhere should still change it there, because a reset at Sony does not reach other sites.

Sony has asked members to watch for suspicious contact, as reported. The company has not said that any member's account was used. That fits an investigation that is still open. It is not a finding that the data is safe.

Sources

So-net notice, October 27, 2026 (Japanese) • Nikkei • ITmedia Mobile