Sony’s So-net breach exposes 2.6m records, 54k mail passwords

Sony’s Japanese ISP just disclosed a breach that exposed nearly 2.6 million customer records—and, more worryingly for email teams, 54,000 mailbox addresses and passwords tied to four legacy mail services.

Sony Network Communications said attackers broke into the So‑net member database on October 19, detected the intrusion on October 23, confirmed the theft and its scope by October 24, and began forcing password resets on October 27, according to an announcement and FAQ.

What happened

The company says 2.14 million of the exposed records belong to So‑net subscribers and 443,000 to Plala (S Course) subscribers, placing the total close to 2.6 million across its Japanese ISP brands. The figures include current and former customers whose data remained on file for billing and support.

Roughly 293,000 of the records concern people who left the services in March 2026 or later, because So‑net keeps details for a period to handle final invoices and follow-up help. The company says credit card data was out of scope, as it does not store card numbers.

Stolen fields include names, dates of birth, gender, phone numbers, email addresses, user IDs, and the network IDs subscribers use to connect to the internet. So‑net said the incident stems from “unauthorized access by a third party,” while the exact intrusion method remains under investigation.

The most immediate email risk comes from about 54,000 addresses and passwords that were taken from four mail offerings: Mail Service (G), A‑Box, So‑net VAIO Mail, and PostPet. So‑net reports the free basic mailbox bundled with subscriptions did not have a detected password leak.

So‑net’s FAQ warns that exposed credentials put a third party “in a position to view, send, and receive emails” via standard clients and So‑net Webmail until resets took effect. The company initiated forced password changes on October 27 to block unauthorized access and restore control.

Investigators say they took the targeted server offline on October 23 and cut traffic from the attackers after spotting the intrusion. By October 24 they had verified that personal data was exfiltrated and had determined the scope sufficient to brief regulators.

A small subset of 16 records contained bank account details—bank and branch, account type, account number, and holder’s name—though So‑net emphasized it does not store account PINs. Other business lines, including NURO, were not impacted based on the current assessment.

Sony Network Communications says it reported the breach to Japan’s Personal Information Protection Commission, aligning with national requirements to notify regulators when sensitive personal data is compromised. The cause and full path of attacker access have not yet been disclosed.

The background

So‑net and Plala are among Japan’s longest‑running consumer internet brands, and their subscriber databases include both active and recent former users, which explains why tens of thousands of ex‑customers appear in the breach scope. Retention for billing closure and support is a common ISP practice.

Credential leakage from mailbox services is a known accelerant for downstream fraud because attackers can reply within real threads, spoof tone, and scrape address books. We’ve covered similar risks after large exposures before, including Capcom’s 11.7 million addresses in 2020 and the follow‑on lures that followed in our report on the Capcom breach and phishing risk.

Mailbox takeovers also link to commoditized infrastructure for sending and hosting phishing. Law enforcement pressure can disrupt these operations—witness the FBI’s seizure of Virtualine’s domain used heavily for scams—but as we noted in our coverage of the Virtualine seizure, actors can often “move next door,” making fresh inbox access even more valuable.

Coalitions have been targeting the cloud accounts that power phishing‑as‑a‑service at scale, reducing some delivery avenues while pushing criminals to hijack trusted accounts. Our report on a large phishing infrastructure takedown detailed how legitimate platforms get co‑opted, a trend that intersects with any event that yields mailbox passwords.

For email programs, subscriber databases with Japanese addresses are likely to see two categories of fallout from this So‑net event: targeted reply‑chain hijacks primed by stolen mailboxes, and scattershot spoofs referencing Sony or So‑net brand names. We’ve previously outlined how to harden filtering and processes during headline‑driven spikes in our playbook to harden deliverability when security headlines spike.

What people are saying

Sony Network Communications’ public materials list the cause as unauthorized access by a third party and stress that credit card data was not affected because it isn’t stored. They also clarify that NURO and other offerings appear unaffected based on current checks.

The So‑net FAQ frames the email risk directly: exposed passwords put a third party “in a position to view, send, and receive emails,” which is why resets were forced on October 27. That language signals concern for misuse of standard protocols like IMAP and webmail, not just web portal logins.

SecurityWeek’s report confirms the sequence—intrusion on October 19, detection on October 23, scope confirmed by October 24, and disclosure plus resets on October 27—indicating a roughly four‑day window between detection and public action, with containment steps starting the day of discovery.

Regulatory posture is explicit: the incident has been reported to Japan’s Personal Information Protection Commission. That aligns with the rising expectation that service providers notify oversight bodies rapidly when personal data is involved, and sets a reference point for similar cases in the region.

The company notes that 16 banking records were exposed, but says no account PINs are held, limiting direct transactional abuse from those fields. Nonetheless, names and account numbers can feed invoice‑swap pretexts if combined with mailbox access, a known pattern in business email compromise.

What happens next

Password resets for the 54,000 affected mailboxes began on October 27 and should neutralize direct use of the exposed credentials, though any emails already scraped or forwarded remain at risk for targeted fraud. Users must set new credentials before resuming service access.

So‑net says it is still investigating the intrusion method and root cause. Until that’s clear, the company will be balancing forensic depth with restoration and reassurance to customers across its So‑net and Plala brands, as well as confirming that other services like NURO remained unaffected.

Senders with Japanese audiences should expect a near‑term rise in lures that reference Sony, So‑net, or Plala, and in reply‑style messages from compromised contacts. That pattern typically follows mailbox password leaks where attackers can harvest historic threads and address books quickly.

The exposure of user IDs and connection IDs also raises the chance of cross‑channel phishing that cites specific customer numbers to sound more credible. Combined with dates of birth and phone numbers, those details can personalize scams that otherwise might be ignored.

Regulatory follow‑through from Japan’s Personal Information Protection Commission could inform how long ISPs retain former customer data for billing and support. So‑net’s note that about 293,000 former users were included may invite debate over data minimization timelines at consumer ISPs.

For incident watchers, the key milestones to track are the completion of password resets, any confirmation of credential misuse prior to October 27, and technical details on the initial access vector. Those points determine how quickly the email‑related risks fade or morph into longer‑tail fraud.

For broader security context, this breach lands amid ongoing efforts to choke off phishing infrastructure and to blunt mailbox‑takeover‑driven fraud loops. You can find more coverage at our Security category hub as we track how email‑centric threats evolve across regions and providers.