Hacker attack hits Sony’s internet provider, exposing millions of records

So-net, a Sony-owned internet service provider (ISP), apologized for an unauthorized access incident that exposed millions of records after malicious actors penetrated its servers.

The Japanese ISP suffered an attack on October 19th, 2026, and detected the intrusion four days later. Upon discovering the breach, So-net’s security team took the affected server offline to prevent further exploitation.

According to So-net, attackers may have accessed 2.1 million customer records. Over 1.8 million belong to current ISP subscribers, while another 272,000 belong to former clients who canceled their service as recently as March 2026.

Meanwhile, the exposed details include:

• Names
• Phone numbers
• Email addresses
• User IDs
• Dates of birth
• Genders
• Internet connection IDs

So-net emphasized that attackers did not compromise passwords for standard accounts. However, intruders accessed email addresses and passwords for users of specific legacy email services, affecting over 54,000 accounts.

Email passwords exposed for legacy services

The So-net data breach also exposed email addresses and passwords for customers using older So-net email services. Over 54,000 email accounts across four legacy platforms were compromised:

• Mail service (G) (@.gyao.ne.jp, @.gate01.com, @.pbc.ne.jp, @.highway.ne.jp): 24,655 accounts
• A-Box (additional mailbox service): 17,672 accounts
• So-net VAIO Mail: 7,005 accounts
• PostPet Mail Account Service: 5,069 accounts

The company confirmed that the free basic mailbox service (@***.so-net.ne.jp) was not affected. So-net reset all exposed email passwords on October 27th. Affected customers will need to manually reset their passwords to regain access to their email accounts.

Plala subsidiary also hit

The data breach extends beyond So-net's direct customers. Attackers also accessed records belonging to Plala, an ISP subsidiary operating under So-net's infrastructure. The breach exposed over 443,000 Plala (S Course) member records, including 422,365 current members and 21,130 former members who canceled after March 2026.

The compromised Plala data matched the categories leaked from So-net: names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs. Attackers did not obtain passwords for Plala customers.

Bank accounts and password reset notifications leaked

In a smaller but more sensitive portion of the breach, So-net confirmed that attackers accessed the bank account information of 16 customers. The leaked banking details included:

• Financial institution names
• Bank and branch numbers
• Deposit types
• Account numbers
• Account holder names

The company emphasized that it does not store account PINs, keeping them safe from the breach.

Additionally, seven customers had password reset notifications exposed. So-net reset those passwords and is contacting affected individuals directly.

The company confirmed that the incident exposed no credit card information. Services outside So-net and Plala, including Sony's NURO internet brand, remained unaffected.

So-net users advised to be cautious

As of October 27th, 2026, So-net has not confirmed any secondary damage from the breach, such as fraudulent account access or identity theft. However, the company warned customers to remain vigilant against suspicious communications exploiting the leaked information.

The company advised customers to:

• Not respond to emails, SMS messages, or phone calls requesting personal information
• Not open links in suspicious message bodies
• Not open attached files from unknown senders

Sony's history with data breaches

Sony has faced high-profile data breaches before. For example, in 2011, the PlayStation Network suffered a massive breach that exposed the personal information of 77 million accounts, leading to a network shutdown lasting 23 days.

So-net reported the incident to Japan's Personal Information Protection Commission, which is investigating the cause and scope of the breach. The company is reviewing its security measures and information management systems to prevent future incidents.

According to reports from Bloomberg, Japan experienced a major surge in AI-powered attacks in recent months. Earlier this month, a massive ransomware attack on Japanese cloud provider IDC Frontier impacted railways, police services, food logistics, and other organizations.

In a statement issued on Wednesday, IDCF Cloud said 495 companies and local government services had been affected by the attack, creating a sprawling cloud supply chain crisis across the country.