Sony Network Communications, the Japanese internet service provider subsidiary of Sony Group Corporation, experienced an unauthorized system intrusion on October 19, 2026, exposing 2,585,481 customer records. The company detected the compromise four days later on October 23, 2026, when administrators cut external network connections and shut down affected servers.
An internal review established that the exposed information from the So-net database includes customer full names, telephone numbers, email addresses, user identifiers, birth dates, gender, and internet connection IDs. Intruders also accessed 54,401 email addresses along with their account passwords, leading the company to urge affected subscribers to reset their credentials. No banking credentials, credit card numbers, or related financial records were accessed.
Impact on Wholesale Partner Networks
The compromised entries comprise 2,141,986 records from the So-net provider service and 443,495 customer records from the plala S Course, representing a combined exposure of 2,585,481 accounts. The breach of plala data spilled into partner provider NTT Docomo, which uses Sony Network Communications infrastructure to deliver its Docomo Hikari broadband service. NTT Docomo confirmed that the incident touches all active Docomo Hikari subscribers and anyone who canceled service during the prior six months.
NTT Docomo alerted customers to look out for fraudulent websites and phishing communications masquerading as its d POINT Club or a Universal Studios Japan campaign promising free tickets. Sony Network Communications formally reported the incident to Japan's Personal Information Protection Commission while continuing to investigate the root cause and the full scope of the intrusion. Neither company had identified malicious misuse or public exploitation of the exposed data as of October 27, 2026. The specific exploit vector and the identity of the intruder remain unknown.
