So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
A third party broke into the So-net member database run by Sony Network Communications, the Sony-owned Japanese ISP, on 2026-10-19. The company spotted the access on 2026-10-23, shut the server down and blocked the source. On 2026-10-24 it confirmed data had left, and it disclosed on 2026-10-27; it has not said how the attackers got in. Exposed: 2,141,986 So-net member records (1,869,771 current, 272,215 who left in March 2026 or later) and 443,495 records of NTT Docomo's docomo hikari "plala (S Course)" customers, whose accounts Docomo had outsourced to So-net's database (Docomo was told on 2026-10-26). Both sets hold name, phone, email address, My Page user ID, date of birth, gender and internet connection ID, but not login passwords. Separately, 54,401 mailbox addresses with their mail passwords were taken from four So-net mail services: Mail Service (G) 24,655 (gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp), A-Box 17,672, So-net VAIO Mail 7,005 and PostPet Mail 5,069. Anyone holding those passwords could read and send mail as the user, so So-net force-reset them without notice from 10:00 JST on 2026-10-27. Also taken: 16 bank account records (bank, branch, account type, number and holder, no PINs; So-net members only) and 7 password-reset notice letters. No card data was involved, and NURO, the Basic Mailbox and My Page login passwords are not affected. Members who left by the end of February 2026 are not in the data. The breach was reported to Japan's Personal Information Protection Commission. As of 2026-10-27 no secondary harm was known, no actor had claimed the attack, and the investigation was ongoing.
What to do
- Affected So-net mail users (@*.gyao.ne.jp, @*.gate01.com, @*.pbc.ne.jp, @*.highway.ne.jp, @abox*.so-net.ne.jp, @*.vaio.ne.jp, @postpet*.so-net.ne.jp): the old mail password no longer works — set a new one in So-net My Page, then update it in every mail client (Outlook, phone mail apps)
- If the leaked mail password was reused anywhere else, change it there now and turn on 2FA — especially accounts that use that mailbox for password resets
- Check the mailbox for forwarding rules, filters, or sent mail you did not create between 2026-10-19 and the reset
- Expect targeted phishing (email, SMS, phone) posing as So-net, Sony or Docomo using your real name, birth date and user ID; do not follow links or open attachments — So-net and Docomo say they will contact affected customers individually
- So-net customers with a bank account on file: watch for debit fraud and calls claiming to be So-net or your bank
- Help lines: So-net 0120-36-8887 (Mon–Sat 10:00–18:00); docomo hikari plala (S Course) 0120-035-700 (daily 10:00–19:00)
- Organisations: treat mail from the listed So-net domains received 2026-10-19 to 2026-10-27 as possibly sent by an attacker; if employees use these addresses for work accounts, force resets
Sources
All live incidents on Threat Watch
