Sony's Japanese ISP So-net Loses 2.6 Million Customer Records to Hackers

Sony Network Communications has confirmed that hackers raided the member database of So-net, its Japanese internet service provider, making off with personal data belonging to nearly 2.6 million current and former subscribers.

The breach happened on October 19. So-net didn't notice until four days later, at which point it pulled the targeted server offline and blocked the attackers' traffic. By October 24, investigators had confirmed data had walked out the door and mapped the extent of the damage.

The haul covers names, dates of birth, gender, phone numbers, email addresses, user IDs, and connection IDs. Of the 2.6 million affected records, around 2.14 million belong to So-net customers and 443,000 to subscribers of Plala's S Course. About 293,000 of those records relate to people who cancelled their subscriptions in March 2026 or later, kept on file for billing and support purposes.

The attackers also grabbed roughly 54,000 email addresses and their associated passwords from four additional mail services: Mail Service (G), A-Box, So-net VAIO Mail, and the PostPet email service. So-net says the standard mailbox bundled with subscriptions wasn't compromised.

On October 27, So-net began force-resetting passwords for all affected email accounts. In its own FAQ, the company acknowledged that anyone holding those credentials would have been able to read, send, and receive emails through both client software and So-net's webmail portal.

Sixteen records containing bank account information were also caught up in the breach, including bank and branch details, account types, account numbers, and account holder names. So-net says it doesn't hold PINs, and credit card data isn't in scope because the company doesn't store it. NURO and So-net's other services appear unaffected.

How the attackers got in remains unknown. So-net has filed a report with Japan's Personal Information Protection Commission and says the investigation is ongoing.