Sony Internet subsidiary suffers cyberattack compromising over 2.5 million customer records

Sony Network Communications revealed that an unauthorized party breached its So-net consumer internet provider database on October 19, 2026. The company detected the intrusion four days later on October 23, promptly shutting down compromised servers and blocking access. Investigations confirmed that more than 2.5 million records of current and former customers were compromised, encompassing 2,141,986 So-net entries and more than 440,000 records tied to plala services, which also affect partner internet provider NTT Docomo. [1][3]

Exfiltrated files included customer names, phone numbers, email addresses, dates of birth, genders, user IDs, and internet connection IDs. The breach also exposed passwords for 54,401 email accounts across several specialized services, including Email Service (G), A-Box, So-net VAIO Mail, and PostPet Mail. TechRadar noted that 16 records containing bank account details were accessed without PINs, though BleepingComputer stated that no banking or payment card details were exposed. Both Sony Network Communications and NTT Docomo warned users to remain alert for phishing attempts, suspicious communications, and fraudulent promotions. [1][2][3]

Sony reported the intrusion to Japan's Personal Information Protection Commission and law enforcement, stating that no extortion attempts or dark web leaks have appeared so far. The incident is part of a wave of cyberattacks across major Japanese telecommunications and internet providers, which previously hit KDDI and GMO Internet Group and prompted urgent government meetings regarding cybersecurity responses. [1][3]