Bad newsSony’s So-net Breach Exposes 2.6 Million Records and 54,401 Email Passwords
Sony Network Communications says an intruder took names, birth dates, and contact details for 2,585,481 So-net and plala customers, plus 54,401 usable email passwords, and went unnoticed for four days. No cause has been named and no compensation offered.
This story runs on the bad side only. The biggest stories of the day are told on both sides.
The password to your mailbox is the kind of thing a company should not be able to lose. Sony Network Communications lost 54,401 of them. On 27 October the Sony subsidiary that runs the So-net internet service said an intruder had reached its member database on 19 October and left with records on 2,585,481 current and former customers. Nobody at the company noticed for four days.
The bulk of the haul is identity data: names, phone numbers, email addresses, user IDs, dates of birth, gender, and the ID used to connect to the internet. It covers 2,141,986 So-net records and 443,495 records for plala (S Course), a service Sony runs under contract for NTT Docomo. Sony says no login passwords for those accounts leaked and that it holds no credit card numbers. Sixteen customers also lost their bank account details, which Sony stores for direct debit, and seven lost the notice used to reset a password.
Chart: GoodBad. Data from Sony Network Communications, notice of 27 October 2026.
The 54,401 are different. For four of Sony’s email services, the intruder took addresses together with the passwords that open them. Sony reset those passwords from 10:00 on 27 October without telling customers first, because, it says, a third party could otherwise have read and sent mail from the accounts. More than half of them, 29,746, belonged to paid add-on mailboxes: A-Box, VAIO mail, and PostPet.
A third of a million of the people affected were no longer customers. The database still held 272,215 So-net and 21,130 plala records for people who had cancelled since March 2026. Sony’s FAQ says it keeps data after cancellation for final billing and enquiries. That retention is routine, and it is why leaving a provider does not take you out of its next breach.
What Sony knew and when
| Date (2026) | What happened, according to Sony and NTT Docomo |
|---|---|
| 19 October | Intruder accesses the So-net member database |
| 23 October | Access confirmed. Server shut down and traffic from the source blocked |
| 24 October | Investigation establishes what leaked and how many records |
| 26 October | Sony reports the plala leak to NTT Docomo |
| 27 October | Public notice. Email passwords force-reset from 10:00. Case reported to the Personal Information Protection Commission |
| 29 October | Letters posted to the 16 bank-account and 7 password-notice cases |
Sources: Sony Network Communications notice (27 October) and FAQ (29 October), NTT Docomo notice (27 October).
Who gets a letter
Those 23 letters are the only postal notices the company describes. For everyone else, Sony’s FAQ says that if it emails you, the same text will appear in the My Page account portal. The same page warns that fake So-net emails about the breach are already circulating. Victims are therefore being told through the channel the attackers are imitating. Docomo’s notice tells its 443,495 plala customers only that they will be contacted individually, without saying how or when.
Sony gives the cause as unauthorised access by a third party, under investigation. It names no attacker, no entry point, and no compensation. Compare Park24, whose Times Car sharing service offered 3,000 yen, about $19, to users whose identity documents leaked after an intrusion detected in September. Sony offers a hotline and an apology.
A crowded month for Japan
So-net is one entry in a long list. Capcom said on 22 October that an intruder took 11,774,247 CAPCOM ID records worldwide, mostly email addresses and login metadata, and changed the passwords on 196 accounts. A follow-up the next day added that 19 of those accounts had their online shop pages opened, exposing names, addresses, and purchase histories. According to AFP, dozens of Japanese businesses have reported unauthorised access to their systems in recent weeks. GMO Internet says it received a ransom demand of about 8 billion yen, roughly $50 million, after an intrusion into a cloud desktop service used by traders, TechCrunch reported.
Prime Minister Sanae Takaichi convened the first ministerial meeting on cybersecurity on 26 October. The official record has her describing a serious situation, with rising fear of secondary harm from misused data, and ordering an emergency package of measures within the following week. The package is to widen consultation desks at the IPA and the police, pool incident reports across ministries, and keep open the option of neutralising attackers’ servers. None of it reaches the 2.6 million people whose details are already gone.
Why there is no other side
GoodBad looked for a good rendering of this story and did not find one. The facts that could carry it are the minimum a breached company owes: the server was shut down, the passwords were reset, a regulator was told, and a hotline opened. No cause has been found, no one has been compensated, and the people affected are being told through a channel that phishers are already copying. The next test is Sony’s own: whether the investigation it promised names how the intruder got in, and whether the 2,585,481 are told individually rather than asked to check a portal.
