Sony Network Communications recently confirmed a significant data breach affecting its So-net and Plala internet services. The breach has exposed 2,585,481 customer records, raising concerns over data security.
Details of the Breach
The breach was publicly disclosed on October 27, 2026, following the discovery of unauthorized access to Sony’s member database. The compromised information includes contact details, account identifiers, and passwords for specific email services. Affected records comprise 2,141,986 So-net and 443,495 Plala accounts, impacting both current and former subscribers.
Impact on User Accounts
Among the exposed data are personal details such as names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Fortunately, Sony confirmed that passwords for primary membership accounts and credit card information were not compromised. However, email credentials for 54,401 accounts across Sony’s services were exposed, prompting a password reset by Sony.
Response and Investigation
The breach’s unauthorized access occurred on October 19, but Sony detected it by October 23. The company swiftly halted affected servers and blocked communication from the intrusion source. An investigation confirmed the data categories involved, and Sony has reported the incident to Japan’s Personal Information Protection Commission. While the exact cause remains unidentified, Sony continues to examine the breach’s full impact.
Additionally, 16 bank account records were exposed, containing sensitive information like bank names and account numbers, though no bank PINs were stored. Seven records involving password reset documents were also affected, necessitating further password resets.
Customer Precautions
This breach underscores the importance of vigilance against phishing and scams. Users are urged to directly access official account websites, reset affected email passwords, and be wary of suspicious links or attachments. As of the latest update, Sony reported no secondary harm but advised caution against potential phishing attempts.
This incident is distinct from the previous Sony MOVEit data breach, which targeted different systems. As Sony continues its investigation, affected users should remain alert to any unusual account activity.
