Sony Network Communications

Summary

Sony Network Communications confirmed a hacker attack on its member database affecting internet provider and plala customers, with approximately 2.59 million records stolen including names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs. The breach also exposed mailbox passwords for 54,401 addresses across four email services and sixteen bank account records, while credit card numbers and primary account passwords were not compromised. The company detected the intrusion several days after it began, shut down the affected server, and reported the case to Japan's Personal Information Protection Commission, noting no confirmed secondary damage at the time of announcement.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Sony Network Communications, the group company that operates the Japanese internet provider So-net, confirmed on October 27, 2026, that a hacker attack had compromised its member database. So-net, founded in 1995 and wholly owned by Sony, is headquartered in Shinagawa, Tokyo, and provides home internet access and personal mailbox services to subscribers. The company also operates plala, a second internet access service known as plala Sコース. Unauthorized access to the member database from outside began on Monday, October 19, 2026. Sony did not detect the intrusion until Friday, October 23, four days after the attackers gained entry. On that same day, the company confirmed the access, shut down the affected server, and blocked traffic from the source of the attack. The investigation continued through Saturday, October 24, when investigators identified the personal data leak and determined the specific items and numbers involved. Sony made the public announcement on Tuesday, October 27, eight days after the initial intrusion, and reset the affected mailbox passwords on that same day.

The breach exposed 2,585,481 records across So-net and plala customers, counting records rather than distinct individuals. The largest group comprised 2,141,986 So-net records, including 1,869,771 current customers and 272,215 former customers who canceled from March 2026 onward. Each record contained name, phone number, email address, user ID, date of birth, gender, and the ID used to connect to the internet. A second group consisted of 443,495 plala records, with 422,365 current members and 21,130 former members, carrying the same data fields. Former customers who canceled by February 2026 were outside the database because the company retains data for a period after cancellation to handle final billing and support. In addition to membership records, sixteen bank account records were stolen, containing bank name and code, branch, account type, account number, and holder name, though the PIN was not included because So-net does not store it. Seven items tied to communications generated for password resets were also exposed, and the company had already invalidated those items.

Passwords for the So-net My Page login did not leak, and credit card data was not compromised because So-net does not store credit card numbers. NURO, the group's high-speed fiber service, and PlayStation Network were outside the affected perimeter. However, mailbox passwords for 54,401 email addresses were stolen across four services. Mail Service G, a free service, accounted for 24,655 addresses. A-Box, a paid additional mailbox service, accounted for 17,672 addresses. So-net VAIO Mail, a paid service, accounted for 7,005 addresses. PostPet Mail, a paid service, accounted for 5,069 addresses. Sony did not disclose whether the mailbox passwords were stored in plain text or encrypted form. The company reported the case to Japan's Personal Information Protection Commission and launched a review of its security and information management. As of October 27, no secondary damage had been confirmed, meaning no abuse of the stolen data had been reported. Sony established a dedicated telephone line at 0120-36-8887, operating from 10 a.m. to 6 p.m. Monday through Saturday, with extended hours until 8 p.m. on October 27 and on November 1 and 3, and directed customers to its FAQ for updates.

A precedent existed for So-net from May 2011, when an intruder accessed the provider's system shortly after the PlayStation Network data breach and took virtual points worth approximately $1,225. The figures released on October 27 reflected the investigation as of October 24, and Sony stated that the cause and scope remained under verification, so the total count could rise or be revised. The notice did not identify the attacker or the method used to gain entry. The eight-day gap between the initial intrusion on October 19 and the public announcement on October 27 meant that customers had no indication they needed to change their passwords during that period.

Sources

Sources available to members: 1 source.