Sony Data Breach Exposes 2.58 Million ISP Customer Records

Sony Network Communications has confirmed a data breach that exposed 2,585,481 customer records from its member database. The compromised system sits behind So-net, the internet access service the Sony subsidiary runs in Japan. Attackers reached it on October 19, and the company detected the activity four days later. Investigators identified the exposed categories on October 24, and public disclosure landed on October 27.

Sony Confirms a Data Breach Across Two ISP Brands

The exposed records split across two services, with So-net accounting for 2,141,986 entries and plala (S Course) making up 443,495. Each entry can carry a full name, phone number, email address, user ID, date of birth, gender and internet connection ID. Sony states that no membership passwords sat alongside those fields, and no credit card data appeared anywhere in the set.

Counting matters here, because 2.58 million refers to database entries rather than confirmed individuals. Someone holding both a So-net account and a plala line could appear twice. Sony has not published a deduplicated total, so the number of people affected by the data breach sits below the headline figure.

Sony says the data breach did not reach NURO or any service outside the two brands it named. The company reported the incident to Japan’s Personal Information Protection Commission and continues to investigate the cause. Work on the full scope remains open, so the figures could still move.

Email Credentials and Bank Records Form a Second Exposure

Beyond the membership fields, Sony confirmed that the data breach reached 54,401 email addresses along with their matching passwords. Those credentials carry the sharpest risk in the incident. An attacker with a working mailbox login can reset passwords elsewhere and seize accounts the victim never linked to their provider.

Sony reset every affected email password on October 27 and asks those users to choose a new one through My Page. Two smaller categories round out the exposure. The company found 16 bank account records holding institution and branch details, account numbers and holder names, plus seven password-reset notification documents.

No credit card data appeared in the compromised set, which limits immediate payment fraud. Bank account numbers alone will not move money without further authentication. However, they feed convincing impersonation, because a caller who recites a branch and account number sounds like the bank.

Four Days Between Intrusion and Detection

The timeline carries as much weight as the record count, because Sony needed four days to notice the data breach. That window gives an intruder room to enumerate records and stage them for extraction. The company has not disclosed what triggered detection on October 23.

Containment then moved faster than detection did. Sony stopped the affected servers and blocked the attack source the same day it confirmed the access. Investigators classified the leaked categories by October 24, and the public notice followed three days later.

Sony has also not said how the attackers got in. No vulnerability, stolen credential or third-party route appears in the disclosure. That gap matters for other operators, because they cannot measure their own exposure against a method nobody has named.

Docomo Hikari Customers Caught in the Fallout

A large share of the exposed set belongs to people who never signed a contract with Sony. The plala (S Course) records cover customers of Docomo Hikari, the fibre service NTT Docomo sells across Japan. Sony Network Communications delivers that service under contract, so the subscriber data sat in its systems rather than Docomo’s.

Docomo issued its own notice the same day, covering all 443,495 affected Hikari customers. Those subscribers chose Docomo and pay Docomo. Sony’s systems still exposed their names, birth dates and connection IDs through this data breach.

Outsourced network operations spread risk in exactly this way. Enterprises rarely map which third party holds customer records, and consumers almost never know. A compromise at one provider then becomes a notification duty for another.

Cancelled Accounts Still Held in a Live Database

Sony’s disclosure places 272,215 So-net records from people who cancelled since March 2026 inside the data breach, against 1,869,771 current members. The plala split runs the same way, with 21,130 former customers and 422,365 active ones. Former subscribers account for roughly one in nine of the exposed records.

Retention policy sits at the centre of that number, because those customers left months ago. Their personal data stayed in a production system attackers could reach. Every month of retention past the point of business need adds records to the next incident.

Billing reconciliation, record-keeping and win-back marketing keep former customer data alive at most operators. None of those purposes requires a live production database. Sony has not explained the decision, and 293,345 cancelled customers now carry the result.

The Phishing Risk Behind Clean Identity Data

The absence of membership passwords reads as reassuring at first glance. Yet the combination that did leak works better for social engineering than a password dump would. A caller who knows a name, birth date, phone number and connection ID can pass as the provider.

Sony warned customers about suspicious email, SMS and phone contact after the data breach, and that warning carries weight. Attackers with verified subscriber details can craft messages referencing a real account and a real billing relationship. Generic filters struggle against that specificity, because nothing in the message looks wrong.

Practical defence now falls largely to the customers named in those records. Anyone with a So-net or plala (S Course) account should reset their email password, stop reusing it elsewhere and turn on multi-factor authentication. Treating unexpected contact as hostile until verified through official channels remains the most effective habit available.

Questions Sony Has Not Answered

Sony has published precise counts, data categories and a clear timeline, but nothing about the entry point. As of October 27 the company had confirmed no secondary harm. That status reflects what investigators could see at the time, not a guarantee for the months ahead.

No group has publicly claimed the intrusion at Sony, and no extortion demand has surfaced alongside the data breach. Attackers who stay quiet often sell data rather than pressure the victim. An early campaign stage looks identical from outside, so neither reading is safe.

Affected customers should reset the email password, watch for impersonation and treat account-related messages with suspicion. Two details carry past this incident for other operators, namely subscriber data held by a contractor and cancelled customers kept in a live system. Sony will publish more as its investigation into the data breach progresses.