Sony Network Communications has confirmed that a cyberattack exposed personal information belonging to approximately 2.5 million current and former customers in Japan. The company said attackers accessed databases supporting its So-net internet service, while a separate group of email addresses and passwords was also exposed.
Sony Network Communications breach exposed 2.5 million records
Sony Network Communications, a subsidiary of Sony Group Corporation, provides internet and technology services in Japan. The company said the breach occurred on October 19 and was detected four days later, when it shut down the affected servers and blocked external communications.
In its October 27 announcement, Sony Network Communications said attackers illegally accessed the So-net member database used to support its internet connection service.
The investigation found that 2,585,481 customer records had been compromised. The exposed information included:
- Full names
- Telephone numbers
- Email addresses
- User IDs
- Dates of birth
- Sex
- Internet connection IDs
Sony Network Communications said bank account information, payment card details and other account information were not compromised.
In addition, 54,401 email addresses from several email services were exposed along with account passwords. The company is advising affected users to change their passwords.
So-net and Plala records affected
According to Sony Network Communications, the exposed records include 2,141,986 So-net records and 443,495 Plala (S course) records. The Plala records involve another internet service provider, NTT Docomo, which has an agreement with Sony Network Communications to provide Docomo Hikari services.
NTT Docomo also notified customers about the incident and warned about phishing emails. The company also cautioned customers about fake websites posing as campaigns for d Point Club and Universal Studios Japan (USJ). These sites falsely claim that visitors have won prizes and ask them to submit personal information to receive tickets.
NTT Docomo said the incident affects all customers currently using its Hikari service, as well as customers who canceled their subscriptions within the previous six months.
Investigation continues as Japan faces more cyberattacks
Sony Network Communications has reported the incident to Japan’s Personal Information Protection Commission and is investigating its cause and scope. As of October 27, neither Sony Network Communications nor NTT Docomo had confirmed any misuse of the exposed data.
The breach follows multiple cyberattacks against high-value companies and service providers in Japan since the beginning of the year.
One recent incident involved GMO Internet Group, whose name-based desktop cloud service suffered a widespread malware attack affecting customers’ servers. Telecommunications company KDDI also disclosed a breach affecting 12 million customers, while IDC Frontier was targeted by ransomware.
Earlier, in 2025, hackers attacked NTT and gained access to its systems, stealing data from 18,000 customer companies.
Amid the growing number of incidents, the Japanese government held an emergency meeting to address the country’s cybersecurity response.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com