Unauthorized System Access Raises Concerns for Millions of Internet Service Users


Investigation Identifies Exposure Across Two Service Platforms

Sony Network Communications has disclosed a security incident affecting its So-net and Plala (S Course) internet services in Japan.

The company reported that 2,585,481 customer records were exposed, while passwords associated with 54,401 email addresses were compromised. Sony stated that primary membership passwords and credit card information were not affected.


The affected database contained 2,141,986 So-net records and 443,495 Plala records. Exposed information included names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection identifiers.


Unauthorized Access Detected in October

According to the company’s disclosure, unauthorized access occurred on October 19, 2026. Sony identified the incident on October 23, shut down the affected servers and blocked communications from the unauthorized source. By October 24, the investigation had confirmed the exposure of personal information.


Sony announced the incident publicly on October 27 and said it was continuing to investigate the cause and full scope of the intrusion. The company has not publicly identified the initial access method, an exploited vulnerability or the responsible threat actor.


Email Passwords Reset Following Exposure

The compromised email credentials were associated with four services:


- Mail Service (G): 24,655 addresses
- A-Box additional mailboxes: 17,672 addresses
- So-net VAIO Mail: 7,005 addresses
- PostPet Mail: 5,069 addresses


Sony reset passwords for the affected email accounts on October 27. The company distinguished these credentials from the primary membership passwords used to access So-net and Plala accounts, which it said were not exposed.


The incident also involved 16 bank-account records containing financial institution and account details, along with account-holder names. Sony said it did not retain bank PINs.

 Seven records connected to password-reset notifications were also exposed, prompting password resets for the affected users.


Credit card information was not included in the exposed dataset. Sony also said it had not confirmed exposure involving other services, including NURO.


Former Subscribers Also Included

The affected population includes 272,215 former So-net members and 21,130 former Plala members who canceled their subscriptions in March 2026 or later. Customers who had terminated their subscriptions by the end of February 2026 were not included in the reported incident.


Potential for Targeted Phishing and Impersonation

Even without primary account passwords or payment-card details, the exposed information could support convincing phishing attempts, impersonation and social engineering. Attackers may combine names, contact details and service identifiers to create messages that appear to come from legitimate providers.


Sony advised affected users to reset passwords through the official So-net My Page portal and to avoid suspicious emails, text messages, phone calls, links and attachments.


The company said it had not confirmed secondary harm as of October 27. However, the absence of confirmed follow-on abuse does not eliminate the risk. The investigation remains ongoing, and Sony has pledged to review its security controls and information-management practices.