Data Breach at Sony ISP Subsidiary Exposes 2.5 Million Customer Records in Japan

Sony ISP Subsidiary Confirms Massive Data Breach

Sony Network Communications, the internet service provider (ISP) arm of the Japanese tech giant, has confirmed a significant data breach impacting approximately 2.5 million current and former users. The unauthorized access affected the company's consumer-facing ISP brand, So-net, as well as infrastructure utilized by other providers.

According to the company's public notices, the breach occurred on Monday, October 19, 2026, and was detected four days later on October 23. Upon discovery, the firm shut down the affected server and blocked the source of unauthorized access.

Impacted Data and Affected Services

Investigations revealed that the attackers exfiltrated over 2.1 million sensitive records. The exposed information varies by service tier:

• So-net Members: Approximately 1.8 million current and former members had details exposed, including names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs. Sony stated that general account passwords were not leaked.
• Plala and NTT Docomo: Over 440,000 records were taken from plala (S Course), affecting customers of NTT Docomo, which uses Sony's underlying infrastructure.
• Email Services: Specific mailbox services suffered credential leaks, including Email Service (G), A-Box, So-net VAIO Mail, and PostPet Mail Account Service, affecting thousands of current and recent subscribers.
• Banking Details: A small subset of 16 records containing bank account information—such as account numbers and holder names—was exposed. Sony confirmed that banking PINs are not stored by the company and remained secure.

Response and Verification

Sony has notified the Personal Information Protection Commission and law enforcement agencies. The company is contacting affected individuals directly and urging vigilance against potential phishing and fraud attempts stemming from the leak.

As of the initial disclosures, no threat actor has claimed responsibility, and the stolen data has not yet surfaced on the dark web. Independent verification of the announcement can be pursued through official Japanese regulatory filings and consumer notices published directly on the So-net and NTT Docomo portals.