← Sony Network Communications

2026 Sony Network Communications (So-net, plala) — member database intrusion; 2,585,481 current and former members’ personal details leaked

2026 2.6M records affected Share on X

Data compromised

For 2,585,481 records (2,141,986 So-net; 443,495 plala S Course, including members who left after February 2026): names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs. 16 bank-account records (institution name and account number, no PINs). 7 password-reset notice records. Passwords for 54,401 addresses across certain email services (G, A-Box, So-net VAIO Mail, PostPet Mail) were exposed, and Sony reset them on October 27. No credit-card data, and member-account passwords were not leaked.

Technical writeup

The So-net notice dated October 27, 2026 (“So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ”) confirms the incident; the notice page we could load shows only its headline, so the figures come from Japanese press coverage of the notice (Impress Watch, ITmedia, Nikkei). Former members who left before March 2026 are excluded, per the coverage. The notice does not describe the entry method. Expect phishing that quotes names, birth dates or bank details. companyConfirmed true.

Root cause

Unauthorised access to the So-net member database by a third party; the cause is still under investigation. The intrusion took place on October 19. Sony Network Communications detected it on October 23, shut down the affected server and blocked the attacker’s connections. The personal-data leak was identified in an investigation on October 24. Reported to Japan’s Personal Information Protection Commission.

References

Breaches you may like