So-net says 2.59 million member records leaked. Reset affected mail passwords and expect phishing

In brief

Sony Network Communications, which runs the Japanese internet provider So-net, said on 27 October 2026 that its member database was accessed without authorisation on 19 October. It says it confirmed the access on 23 October and stopped the affected server.

The company gives the cause only as unauthorised access by a third party, still under investigation. No source we checked names an attacker.

What the notice lists

• Member records. The notice lists 2,141,986 So-net records and 443,495 records for docomo Hikari plala (S course) customers. 2,585,481 in total. NTT Docomo confirms the plala figure.
• Data exposed. Names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. So-net says no login passwords were in these records.
• Email passwords. 54,401 addresses on four mail services were taken with their passwords. So-net says it reset those passwords on 27 October.
• Bank details. So-net confirms 16 bank-account records leaked and says it holds no account PINs.
• Other items. Seven password-reset notice records leaked, and those passwords were also reset. So-net says none of the leaked data includes credit card details, and it has found no leak from NURO or its other services.

Why it matters

So-net's notice says former customers who left in March 2026 or later are included, and those who left by the end of February are not. The leaked details make impersonation scams more convincing. Both companies say no secondary harm had been confirmed as of 27 October.

What affected users should do

1. Reset your mail password through So-net My Page if you use one of the four affected mail services. So-net says this is required.
2. Watch for phishing. So-net and Docomo advise not responding to suspicious emails, texts or calls, and not opening their links or attachments.
3. Change reused passwords on any other account that used the same mail password.

Sources and scope

• Sony Network Communications, So-net notice of 27 October 2026, the primary source for all figures.
• NTT Docomo, notice on plala (S course) customers, 27 October 2026.
• Help Net Security, Data breach at Sony-owned internet provider compromises 2.6 million customer records, 28 October 2026.

Checked 28 October 2026. The "Why it matters" section and the advice on reused passwords are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.