Sony So-net breach exposed 2.58 million records including Docomo Hikari users

Sony Network Communications, the Sony Group company behind Japan's So-net internet service, has disclosed that an intruder reached its membership database and made off with personal information belonging to more than 2.58 million people. According to a report by Joho no Todai republished on dev.to, the compromised data covers current and former So-net members as well as customers of Docomo Hikari's plala (S Course) fibre service, which So-net operated under an outsourcing contract.

How the intrusion unfolded

The unauthorized access took place on October 19, 2026. Sony Network Communications only spotted the anomaly four days later, on October 23, at which point it took the affected server offline and cut off communication with the intruder. The company verified the personal information leak the following day, October 24, and publicly disclosed the incident on October 27.

So far the company has attributed the incident only to an outside party accessing its systems without permission. The report notes that the entry point and the techniques involved are still being investigated, and that Sony has reported the incident to Japan's Personal Information Protection Commission.

What was taken

The So-net side of the breach covers 2,141,986 membership records: 1,869,771 for current members and 272,215 for former members who canceled from March 2026 onward. Members who canceled by the end of February 2026 are not affected. The exposed fields include names, telephone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Membership account passwords were not exposed.

The more serious element is email credentials. Four So-net email services had both addresses and passwords compromised, totalling 54,401 records: Email Service (G) with 24,655, A-Box additional mailboxes with 17,672, So-net VAIO Mail with 7,005, and the PostPet Mail Account Service with 5,069. Sony forcibly reset those passwords on October 27, and affected users must now set new ones through So-net My Page.

A small number of more sensitive records were also hit: 16 bank account records containing financial institution, branch, account number and account holder details, plus seven member notification records used in password resets. No credit card information was included, and the company says it has found no leaks from other services it runs, such as NURO.

Docomo Hikari customers and phishing warnings

NTT Docomo disclosed the same day that 443,495 records tied to Docomo Hikari's plala (S Course) service leaked because the data sat in the same database operated by Sony Network Communications. Active customers and those who canceled within the previous six months are affected. The exposed fields mirror the So-net membership data, but Docomo says no passwords, credit card information or bank account details were included, and that customers on other plala plans were not affected. A dedicated inquiry line (0120-035-700) is open daily from 10 a.m. to 7 p.m.

Docomo also warned of phishing emails impersonating its d POINT CLUB programme, which claim recipients won a USJ promotion and direct them to a fake ticket site that collects personal information. Docomo says no such promotion exists. Phishing that arrives right after a leak can use stolen details to appear legitimate, so treating links in unfamiliar emails with suspicion is the safest defence.

A wider pattern across Japanese infrastructure

The report situates the incident in a broader wave of attacks during 2026: an attack on GMO Internet's Onamae.com Desktop Cloud, a leak at KDDI reported to affect around 12 million people, and ransomware at IDC Frontier, following a 2025 intrusion into NTT systems that exposed data on 18,000 corporate customers. Prime Minister Sanae Takaichi convened a meeting of relevant ministers on cybersecurity on October 26, describing the repeated attacks and resulting leaks as serious and requiring urgent countermeasures. She pointed to simulated attack testing using advanced AI and a cyberattack monitoring network covering small and midsize businesses.

Why it matters

As of October 27 no misuse of the leaked data had been confirmed, but the combination of names, phone numbers, dates of birth and email addresses is exactly the raw material that phishing campaigns and identity-verification bypasses are built on. For the 54,401 users whose email passwords leaked, password reuse makes account takeover on unrelated services a live risk, which is why the forced resets matter. Beyond So-net itself, the breach is the latest in a series serious enough to prompt a national-level response, a signal that Japan's communications infrastructure is being targeted at a scale its government now treats as an emergency.