Sony Network Communications breach exposes 2,585,481 So-net and plala records in Japan

Sony Network Communications confirmed on October 27, 2026 that unauthorized access to its So-net membership database exposed 2,585,481 records: 2,141,986 So-net membership records and 443,495 plala (S Course) records. The exposed fields include names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Within that population, email passwords for 54,401 email addresses across four mail services were also exposed, and 16 bank account records were exposed, covering bank and branch, account type and number, and holder name, with no PINs stored. Sony said no credit card data was exposed, no So-net membership passwords leaked, and NURO was not affected.

The intrusion occurred on October 19, was discovered on October 23, and a leak was confirmed on October 24. Sony shut down the affected server and blocked the access source, reset the compromised email passwords on October 27, reported the incident to Japan's Personal Information Protection Commission, and said it had not identified subsequent harm as of October 27.

Sources: CyberInsider; Beebom