So-net and plala breach: 2.58 million records and 54,401 email passwords leaked

If you have, or recently had, internet service from So-net or plala (S Course) in Japan, expect a letter and be wary of unexpected messages. Sony Network Communications says attackers broke into the So-net membership database and took about 2.59 million customer records, and that passwords for 54,401 So-net email addresses leaked too.¹

Reporting checked October 28, 2026.

Too long; didn’t read?

• Leaked: name, phone number, email address, user ID, date of birth, gender and internet connection ID for 2,141,986 So-net and 443,495 plala (S Course) records. Account passwords were not in this data.¹
• Passwords for 54,401 addresses on four So-net email services also leaked. Sony reset them on October 27, so those users must set a new one.¹
• No credit card details were involved. Bank account details of 16 customers were leaked.¹
• Don’t reply to unexpected emails, texts or calls, and don’t open their links or attachments.¹

What happened

According to Sony Network Communications, an outsider accessed the So-net membership database on October 19, 2026. The company noticed on October 23, shut down the server and blocked the attacker’s connection, and by October 24 it knew what had been taken. It says the cause, unauthorized access by a third party, is still under investigation, and it has reported the incident to Japan’s Personal Information Protection Commission.¹

The database also held customer records for plala (S Course), a Docomo Hikari internet plan that Sony runs for NTT Docomo. Docomo says Sony told it about the breach on October 26.²

Who is affected

Sony gives these numbers:¹

• So-net members: 2,141,986 records, of which 1,869,771 are current members and 272,215 are people who left in March 2026 or later.
• plala (S Course) members: 443,495 records, of which 422,365 are current members and 21,130 are people who left in March 2026 or later.
• People who left before the end of February 2026 are not affected.

For both groups, the leaked details are name, phone number, email address, user ID, date of birth, gender and internet connection ID. Sony says passwords were not part of these records, and no credit card information was involved anywhere in the breach. It has not found leaks from NURO or its other services.¹ Docomo says other plala services, such as plala (Docomo Hikari), were not affected.²

The email passwords

The more urgent problem is a separate leak of email addresses with their passwords for four So-net email services: Mail Service (G) for former GyaO users (24,655 addresses), A-Box extra mailboxes (17,672), So-net VAIO Mail (7,005) and PostPet mail accounts (5,069). Sony reset all of these passwords on October 27 to stop anyone using them.¹ So-net says the free basic mailbox that comes with membership was not affected.³

Sony also confirmed leaks of bank account details for 16 customers (bank, branch, account number and account holder name, but no PIN, which it says it doesn’t hold) and of 7 password-reset letters, whose passwords it has reset. It says it will contact the affected customers individually.¹

Why it matters even without passwords

A name, phone number, email address and date of birth are exactly what scammers need to sound like your internet provider. As of October 27, Sony said it had not seen any misuse, but warned that suspicious contact using the leaked data may follow.¹

Docomo is separately warning about fake emails that pretend to be from its d POINT Club and claim you have won Universal Studios Japan tickets, prompting people to enter personal details to claim them.^{4, 5} Nothing links that campaign to this breach, but it shows the kind of message to ignore.

What you can do

• If you use one of the four email services, set a new email password from the So-net My Page, following So-net’s two restart steps. Your email app won’t work with the old password.^{1, 3}
• If you used that email password anywhere else, change it there too, starting with your bank and shopping accounts. A long, unique password for each account stops one leak from spreading; BellCrier’s free password generator can make one for you.
• Don’t reply to unexpected emails, texts or calls, don’t open their links and don’t open attachments, as Sony advises.¹
• If someone calls “from So-net” or “from Docomo”, hang up and call back on a number you find yourself. So-net’s dedicated line is 0120-36-8887 (weekdays and Saturdays, 10:00 to 18:00).¹
• Read the official questions and answers page for the latest details.³

Sources

1. Sony Network Communications, October 27, 2026: Apology and notice about the information leak caused by unauthorized access to the So-net membership database (in Japanese)
2. NTT Docomo, October 27, 2026: Notice about the leak of plala (S Course) customer information (in Japanese)
3. So-net: Questions and answers about unauthorized access to the So-net membership database (in Japanese)
4. NTT Docomo, October 27, 2026: Beware of fake emails and websites imitating Docomo’s USJ campaign (in Japanese)
5. BleepingComputer, October 28, 2026: Sony ISP subsidiary data breach exposes 2.5 million customer records