Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records

Sony Network Communications, the Sony Group subsidiary behind the So-net internet service, said on 27 October 2026 that an unauthorised party had accessed its So-net member database and exposed 2,585,481 customer records. The company's notice, published in Japanese, divides that figure into 2,141,986 So-net entries and 443,495 plala (S Course) records. Plala's S Course is the service underneath NTT Docomo's Docomo Hikari, which Docomo contracts Sony Network Communications to provide, so the smaller number reaches people who never held a Sony account.

Related reading: Spain Logs Its First Data Breach Carried Out by an Autonomous AI Agent · Leakers$ Hijacked Public LED Billboards in Egypt, Malaysia and Brazil.

The access ran undetected for four days. It happened on 19 October and was detected on 23 October, when Sony shut down the compromised servers and blocked external communication. The company published its notice on 27 October and reported the incident to Japan's Personal Information Protection Commission. The cause and the full scope are still under investigation.

What the 2.58 million records contain

The exposed fields are the ordinary contents of a member database:

• Identity: full names, dates of birth and gender.
• Contact: phone numbers and email addresses.
• Account: user IDs and internet connection IDs.

Sony says no banking details, payment card numbers or other account details were in the records. That limits one kind of loss. It does not make the list harmless, because the fields that were taken are the ones used to prove identity elsewhere.

The count is also a records count. Sony has not published a figure for unique individuals, and one person can appear in more than one entry. The 54,401 email-and-password records sit outside the 2,585,481 entirely, and Sony has not said whether the two sets overlap. Docomo's notification to its own customers covers a separate group. Adding the figures produces a number larger than the evidence supports.

The Docomo Hikari link

Docomo Hikari is sold by NTT Docomo, but the service behind it is plala's S Course, supplied under contract by Sony Network Communications. That arrangement is why a breach at a Sony subsidiary lands on Docomo's customers. Docomo notified them on 27 October and said the incident affects all current Hikari customers as well as anyone who cancelled within the preceding six months.

The two statements do not map onto each other. Sony counts 443,495 plala (S Course) records. Docomo describes an affected population of all current Hikari customers plus recent cancellations. Neither company has published a reconciliation, and the record count is not a customer count in either direction.

Docomo's notice went beyond the record count. In a separate warning it told customers to watch for phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign. The fake messages tell recipients they have won tickets and ask them to enter personal information to claim a prize that does not exist. The messages are using a real breach at a real supplier to make a false offer look plausible.

That is the practical shape of this incident for most affected people. Most of them will not read a Japanese PDF from a Sony subsidiary. They will get an email or a text that already knows their name, their provider or their address, and it will ask for one more detail.

Fifty-four thousand passwords in a second set

Alongside the customer database, Sony says 54,401 email addresses from several email services were exposed together with account passwords. It advises affected users to change those passwords. The company has not named the email services, which means the people in that set cannot identify themselves from the public notice alone.

This set is the more immediately dangerous of the two, and it is the one most likely to be misread. An email address and a working password are directly usable against any other service where the same pair was reused. The stolen records do not need to include banking details for that to cost someone money, because the password may open an account that does. Sony has not described how the passwords were stored, so whether they are usable as they stand is unknown.

The customer records are a different problem with a longer tail. A name, date of birth, phone number and email address are enough to make a convincing first contact, and enough to answer questions that some services still treat as proof of identity.

Why an ISP list is worth stealing

An internet provider holds the billing relationship, the login and the physical line. Even with payment data excluded, the remaining fields describe a person and the service they depend on. That combination supports phishing that reads as an account notice, phone calls that quote a real customer number, and attempts to reset passwords elsewhere using details the target will recognise. The phone number matters as much as the email address, because a caller who already knows the name and the provider has a script.

The connection IDs are the least self-explanatory field in the list. Sony calls them internet connection identifiers; it has not explained whether they can be used to reach a customer's line or only to identify the account internally. Either way, they tie a record to a specific service, which is more than a marketing list offers. The notice does not explain what the identifiers expose.

Nothing published so far shows the data being used. Sony and Docomo both said as of 27 October that they had not confirmed misuse. That is a statement about evidence, not about risk. Absence of confirmation at the point of disclosure does not tell you whether the list is already circulating.

A run of breaches in Japan

The Sony disclosure arrived in the middle of an unusually bad stretch for Japanese network operators. GMO Internet's Onamae Desktop Cloud was hit by malware, with up to 27,000 customer servers affected. BleepingComputer's report on the Sony notice also lists KDDI, where a breach affected 12 million customers, IDC Frontier, which was hit by ransomware, and NTT, where data on 18,000 corporate customers was stolen in early 2025.

The sequence was compressed. GMO urged customers to shut down their PCs while it dealt with a ransomware threat on 27 October, the same day Sony published its notice. Japan Times reported that the government held urgent meetings on Monday 26 October to plan a response. The timing is close. None of the reporting links the incidents, and separate breaches at separate companies can fill one week's calendar without sharing an attacker.

"The recent rate of data breaches is so unprecedented and threatening that the Japanese government held urgent meetings on Monday to plan its response." — BleepingComputer, Bill Toulas, 28 October 2026

What affected customers can do

The one instruction Sony gives is to change the password on any account tied to the 54,401 exposed email addresses. Anyone who used the same password elsewhere should change it there too, and a password manager makes that practical rather than theoretical. Two-factor authentication on email and banking accounts covers the case where a password is already known. Changing a password does not close a session that is already open, so signing out other devices and checking recovery options belongs to the same job.

For Docomo Hikari customers, the relevant warning is the phishing one. Messages about d POINT Club or Universal Studios Japan tickets should be treated as false, particularly if they arrive soon after the breach and ask for information to release a prize. Check Docomo's notice directly rather than through a link in the message.

Caveats

Sony has not published the intrusion vector, so there is no way to know whether a patch, a credential or a supplier was involved. It has not named an attacker, and it has not given a forensic timeline beyond the two dates, 19 October and 23 October.

• Records are not people. The 2,585,481 figure counts entries in Sony's database. Sony has not published a unique-person count, and one person can appear more than once.
• The 54,401 set is separate. It is not part of the 2.58 million, and the overlap between the two has not been established. Sony has not named the email services involved.
• No confirmed misuse is not no exposure. Sony and Docomo both said on 27 October that they had found no misuse. The data is still in someone else's hands.
• The scope can still change. Sony says the cause and the full extent are under investigation. The record count published on 27 October may not be the final one.
• The Japanese breach wave is context. KDDI, GMO, IDC Frontier, NTT and Sony have not been linked to a common attacker, and the government meetings are not evidence of one.

The notice published on 27 October gives the count and the dates. It does not say how the access happened or how far it went, and Sony has not said when it will publish more.

Cover image: "Sony headquaters 1.jpg" by Akonnchiroll, CC BY-SA 4.0, via Wikimedia Commons. The photo shows Sony's Tokyo headquarters, not the Sony Network Communications office.