Sony Network Communications, an internet service provider (ISP) subsidiary of Sony, has confirmed a significant data breach affecting approximately 2,585,481 customer records. The intrusion, which targeted the company’s membership databases, has compromised personal information for users of the So-net and plala (S Course) services.
According to an official disclosure from Sony Network Communications, the unauthorized access was first detected on October 23, 2026, following an intrusion that began on October 19. The company confirmed the data leak on October 24 and moved to notify the public three days later.
The breach is partitioned between two primary groups: 2,141,986 records from the So-net membership database and 443,495 records from the plala (S Course) service. The exposed data includes names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs.
Specifics on Stolen Passwords and Financial Data
While general membership account passwords were not compromised in the attack, the company revealed that 54,401 passwords for legacy email services were stolen. These passwords belong to users of older platforms, including Mail Service (G), A-Box, So-net VAIO Mail, and PostPet Mail. Sony has already begun resetting these passwords and contacting the affected individuals.
Regarding financial information, the company stated that the breach was largely contained. Banking details for 16 specific customers were exposed, but Sony confirmed that no credit card numbers, security codes, or PINs were included in the stolen datasets.
PSN and NURO Users Unaffected
A critical distinction in this breach is the separation of Sony’s various digital ecosystems. Sony Network Communications has clarified that this incident does not affect PlayStation Network (PSN) accounts, as those are managed under a different corporate infrastructure. Additionally, users of Sony’s high-speed fiber-optic service, NURO, are not impacted by this specific database intrusion.
Customers who canceled their subscriptions prior to March 2026 are also generally considered outside the scope of the affected records.
Cybersecurity Context in Japan
The timing of the disclosure coincides with a heightened state of cybersecurity awareness in Japan. The country’s new Active Cyber Defense (ACD) law took effect on October 1, 2026, which may have influenced the speed of the investigation and subsequent reporting. This incident also follows a “state of emergency in cyberspace” declared by Japanese authorities earlier in the third quarter of 2026.
In a related security development, NTT Docomo has issued a warning regarding phishing campaigns that may leverage the confusion surrounding recent data exposures. These fraudulent efforts involve fake Universal Studios Japan (USJ) campaigns and “d POINT Club” impersonations designed to trick users into providing credentials.
Sony Network Communications has stated it is currently strengthening its monitoring systems and investigating the exact entry point used by the attackers to prevent a recurrence. Affected customers are advised to remain vigilant against unsolicited communications and to monitor their accounts for any unusual activity.
