Sony Network Communications, the Sony Group subsidiary that runs the So-net internet service in Japan, has confirmed that an unauthorized party accessed its So-net member database server on 19 October. BleepingComputer reports the company detected the intrusion four days later, then shut down the affected servers and blocked external communication. In its 27 October announcement the company said 2,585,481 customer records were exposed, made up of 2,141,986 So-net entries and 443,495 records for plala (S Course), the service Sony Network Communications provides for NTT Docomo’s Docomo Hikari fiber customers.
The exposed fields include full names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony says no banking, payment card or other account details were involved. BleepingComputer reports that a further 54,401 email addresses from several email services were exposed together with account passwords, and that the company advises affected users to change their passwords. Docomo’s own notice says the 443,495 plala (S Course) records cover customers who were subscribed or had cancelled within the previous six months, that the data did not include passwords or payment details, and that no misuse had been confirmed as of 27 October.
Docomo has also warned about phishing: it says suspicious emails posing as its “d POINT Club” are directing people to a fake site about a Universal Studios Japan ticket giveaway, and states that it is not running such a campaign. The incident comes days after the GMO Onamae data-leak warning in a month of heavy breach reporting in Japan.
How to check if you’re affected
Affected products are So-net internet accounts and the plala (S Course) service run for Docomo Hikari. Docomo says it will contact affected plala (S Course) customers individually, and says customers on its other plala plans were not affected.
- If you have a So-net or plala (S Course) account, change that account’s password, and change it anywhere else you reused it. BleepingComputer reports the company advises password changes for the 54,401 email accounts whose passwords were exposed.
- Treat unexpected emails, texts and calls that mention So-net, plala, Docomo or a prize draw as suspect. Docomo’s advice is not to open links in unsolicited messages or enter personal details, and to check its phishing-countermeasures page if you already did.
- Names, phone numbers and birth dates are not changeable, so expect them to be used in targeted scams.
Sources
- Sony ISP subsidiary data breach exposes 2.5 million customer records (BleepingComputer)
- Sony Network Communications announcement, 27 October 2026 (PDF, Japanese)
- NTT Docomo: apology and notice on information leak affecting Docomo Hikari “plala (S Course)” customers (Japanese)
- NTT Docomo: warning about fake emails and sites impersonating a Docomo USJ campaign (Japanese)