Sony ISP Subsidiary Data Breach Exposes 2.5 Million Customer Records

A substantial data breach at Sony's internet service provider subsidiaries, So-net and Plala, has exposed personal information belonging to approximately 2.5 million customers in Japan. The incident, which occurred on October 19, 2026, was discovered four days later, prompting swift action from the company to address the security lapse ¹².

The stolen data encompassed a wide range of personal identifiers, including names, dates of birth, genders, phone numbers, email addresses, user IDs, and internet connection IDs. This extensive collection of sensitive information underscores the potential impact on affected individuals, though fortunately, no credit card data was among the compromised records ¹².

So-net, one of Sony’s internet service providers, took immediate steps to protect its users by resetting the passwords for the impacted email accounts on October 27, 2026. Additionally, sixteen records containing bank account details were leaked, highlighting the need for vigilance among the affected customers ¹.

The cause of the breach has been attributed to unauthorized access by a third party, with an ongoing investigation aiming to uncover more details about the incident. Notably, NTT Docomo, which utilizes Sony Network Communications for its Docomo Hikari services, also informed its customers about the breach, indicating the widespread nature of the issue ¹².

As of October 27th, there had been no reported misuse of the exposed data, providing some reassurance to the affected individuals. However, the timing of this breach coincides with a series of cyberattacks targeting Japanese companies and providers since the start of the year, suggesting a broader trend in cybersecurity threats within the region ².

In response to these increased risks, the Japanese government convened urgent meetings to devise strategies for addressing the growing number of data breaches. These actions reflect the heightened awareness and concern surrounding digital security in Japan ².

What we know

• Hackers stole personal information from So-net and Plala internet subscribers in Japan ¹²
• The attack happened on October 19, 2026, and was noticed on October 23, 2026 ¹²
• Stolen information included names, dates of birth, gender, phone numbers, email addresses, user IDs, and internet connection IDs ¹²
• About 2.14 million records belonged to So-net subscribers and 443,000 to Plala subscribers ¹²
• So-net reset the passwords for the impacted email addresses on October 27, 2026 ¹
• Sixteen records containing bank account details were leaked, but no credit card data was involved ¹
• Cause of the breach is listed as unauthorized access by a third party; investigation is ongoing ¹
• NTT Docomo also notified its customers about the breach ²
• No misuse of the exposed data had been confirmed as of October 27th ²
• Multiple cyberattacks targeting Japanese companies and providers have occurred since the beginning of the year ²
• Japanese government held urgent meetings to plan responses to the recent increase in data breaches ²