Sony Network Communications, which runs the So-net internet service in Japan, confirmed that an attacker got into its member database. About 2.58 million records are affected. Most of it is the usual personal data. The part I care about most is the passwords.
What Happened
According to the company's disclosure, as reported by Help Net Security:
- The attack happened on October 19 and was confirmed on October 23. Sony shut down the affected server and cut off access, and the investigation confirmed the data leak the next day.
- The cause is listed as "unauthorized access by a third party." The investigation is still going.
- It's been reported to Japan's Personal Information Protection Commission.
What Was Exposed
- About 2.14 million So-net records (current members plus people who left in March 2026 or later) and about 443,000 plala records.
- Member data: names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Sony says no passwords were in these records.
- 54,401 email addresses with their passwords across four email services.
- 16 records with bank account details. Small number, but not zero.
- No credit card data.
Sony reset the passwords for the affected email accounts on October 27.
Why the Passwords Matter
Fifty-four thousand email passwords sounds small next to 2.58 million records. It isn't. An email account is the reset button for everything else a person owns. And people reuse passwords. If your So-net mail password is also your password for anything else, an attacker now has a list to try.
The other 2.5 million records are phishing fuel. A message that knows your name, phone number, birthday, and user ID looks a lot more convincing than "Dear customer."
There are also separate reports on X of PlayStation Network account takeovers this week. Sony Interactive Entertainment hasn't confirmed a cause or a link to this breach, and neither am I. Just don't assume one story explains the other.
What To Do
- If you're a So-net or plala customer: set a new password through the So-net My Page portal, and change it anywhere else you reused it. Turn on MFA everywhere it's offered.
- Expect phishing. Sony warns that suspicious messages using leaked data may follow. Don't click links or call numbers from unexpected emails, texts, or calls. Go to the provider directly.
- For security teams with Japanese users or offices: watch for credential stuffing against your own login pages and brief employees on targeted phishing. Personal email breaches turn into corporate account takeovers when passwords get reused.
- For everyone: a password manager and unique passwords make breaches like this somebody else's problem instead of yours.
Bottom Line
The headline number is 2.58 million, but the real risk is the 54,401 email passwords and every other account they unlock. Breaches like this don't end when the server goes offline. They start a phishing and credential-stuffing season.
Sources: Help Net Security and CyberInsider