More than 2.58 million customer records were exposed after unauthorized access struck Sony Network Communications’ member database for So-net and plala (S Course), the company confirmed on October 27, 2026. The scale covers 2,141,986 So-net records and 443,495 plala (S Course) records, according to the official So-net notice. This database leak joins a growing pattern of large-scale personal record exposures.
No passwords tied to those member accounts were leaked, and no credit-card data was involved. That distinction matters, but it does not make this a clean story: the exposed profile data is precisely the kind of information needed to craft a convincing phishing message or impersonation attempt.
What Was Exposed
The compromised records span personal identifiers and, in a small number of cases, financial account details.
Sony’s disclosure confirmed that compromised records included names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet-connection IDs. The investigation also identified 16 bank-account records containing financial institution names and account numbers, though no PINs were involved.
A separate finding involved passwords for 54,401 addresses across certain email services, specifically G, A-Box, So-net VAIO Mail, and PostPet Mail. Sony reset those email-service passwords following the discovery, per reporting by Impress Watch.
What Was Not Exposed
Sony’s disclosure draws a clear line between the compromised email-service credentials and the primary account passwords, which remained protected.
Sony’s disclosure confirmed that general member-account passwords for So-net and plala records were not among the exposed data. Credit-card data and bank PINs remained fully protected, and NURO customer data was entirely unaffected, according to that same disclosure. For more on how credentials and files exposed through unauthorized access can cause lasting harm, related incidents offer important context.
The separation between email-service passwords and primary account credentials is an important one: the former were compromised and reset, while the latter were not touched.
How It Unfolded
The gap between the intrusion and Sony’s public disclosure spanned eight days.
The unauthorized access occurred on October 19, 2026. Sony confirmed the intrusion on October 23 and shut down the affected servers, blocking further communications from the unauthorized source. An investigation completed October 24 confirmed that customer data had been exposed, according to ITmedia and Business+IT reporting. Sony reported the incident to Japan’s Personal Information Protection Commission and disclosed it publicly on October 27.
Former Customers Are in the Data Too
Canceling a subscription did not remove your records from the affected database.
If you canceled a So-net or plala subscription on or after March 2026, your records were still in that database. The disclosed totals include 272,215 former So-net members and 21,130 former plala (S Course) members who had ended their subscriptions, per the So-net official notice.
What Affected Users Should Do
The exposed data provides enough personal detail to support targeted scams and impersonation attempts.
Treat any unexpected email, SMS, or phone call claiming to be from Sony, So-net, plala, a bank, or a delivery company with skepticism. That caution applies regardless of how credible the message appears. Reviewing broader guidance on how to stay safe from impersonation and phishing attempts is a useful step.
Access your accounts directly through official URLs rather than any link sent in a message. If you used the same password for your So-net or plala account on other services, change those passwords and enable multifactor authentication wherever the option exists.
Investigation Ongoing
Sony has not confirmed secondary damage, but the root cause and full scope of the incident remain under investigation.
Sony stated it had not confirmed any secondary damage at the time of its public disclosure, while acknowledging that the exposed information could appear in suspicious communications, according to ITmedia. The investigation into the root cause and full scope of the incident remains open, meaning the confirmed figure of 2,585,481 affected records and the precise method of intrusion are still subject to revision as findings develop.
