2,585,481 customer records were exposed in a breach at Sony Network Communications, the company confirmed — a tally that includes names, phone numbers, email addresses and other personally identifiable information tied to current and former users.
Immediate facts reported by Sony Network Communications
Sony Network Communications, a Sony Group Corporation subsidiary that operates as an internet service provider in Japan, said its So‑net member database was accessed by an unauthorized party. The company reported the incident to Japan’s Personal Information Protection Commission and began an internal investigation into the cause and scope of the access.
The company says the intrusion occurred on October 19 and was detected four days later, at which point it shut down the compromised servers and blocked external communication.
Data types exposed and record breakdown
The investigation confirmed 2,585,481 customer records were exposed. According to Sony Network Communications, the exposed fields include full names, phone numbers, email addresses, user IDs, dates of birth, gender and Internet Connection IDs. The company stated explicitly that no banking, payment card or other account details were exposed.
In addition to the main member database, Sony said 54,401 email addresses from several email services were exposed along with account passwords; the company is advising affected users to change their passwords.
Sony provided a breakdown of the affected entries: 2,141,986 entries came from So‑net, while 443,495 entries were in plala (S Course) records. The plala records relate to services contracted to another provider, NTT Docomo.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildImpact on NTT Docomo and Docomo Hikari customers
NTT Docomo notified customers after Sony’s disclosure. Docomo warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign, saying scammers were falsely claiming winners and prompting recipients to enter personal information to claim tickets.
Docomo said the incident affects all current Hikari service clients and those who canceled within the preceding six months, reflecting the contractual relationship by which Sony Network Communications provides Docomo Hikari services on Docomo’s behalf. As of October 27, neither Sony Network Communications nor NTT Docomo had confirmed misuse of the exposed data in the wild.
Incident timeline, response and advice
According to the company, detection on the fourth day led to an immediate operational response: shutting down the compromised servers and blocking external communications. Sony has reported the breach to the national privacy regulator and is investigating the incident’s cause and scope. The company has advised users, particularly owners of the 54,401 exposed email accounts, to change their passwords to limit the risk of credential abuse.
How this lands for technologists, policymakers, and affected customers
- Technologists and security teams: The exposure of large volumes of PII plus tens of thousands of email/password pairs highlights the continuing risk of credential-based access. The Blue Report 2026 — cited in reporting around this incident — notes that “overall prevention scores can hide what happens after initial access” and that “once attackers are using valid credentials, prevention drops sharply.” The report measures defenses across 338 million simulations in customer production environments.
- Policymakers and regulators: Sony has informed Japan’s Personal Information Protection Commission; regulators will watch incident scope, notification practices and any downstream misuse. The recent rate of attacks prompted urgent meetings of the Japanese government on Monday to plan a response, underscoring national concern about a clustering of high‑impact intrusions.
- Affected customers and consumers: Current and recent Docomo Hikari customers and So‑net members should be alert for phishing tied to d POINT Club and Universal Studios Japan impersonations, change exposed passwords, and monitor communications for fraudulent contact. Sony and Docomo have not confirmed exploitation of the data as of October 27.
Context matters: this breach arrives amid a string of high‑profile incidents in Japan this year, including attacks on GMO Internet Group’s Onamae Desktop Cloud service, a KDDI breach affecting 12 million customers, an IDC Frontier ransomware episode, and an earlier intrusion into NTT systems that stole corporate customer data. The Sony Network Communications disclosure adds another large dataset to that pattern and has already drawn regulator notification and government convening.
The most immediate questions now are operational: how quickly investigators can determine the intrusion vector, whether the exposed email/password pairs have been used elsewhere, and whether targeted phishing campaigns seeded with this data will materialize. Sony Network Communications’ shutdown of compromised servers curtailed active access, and the regulator notification begins the formal record; beyond that, customers and the companies involved will be watching for proof of misuse and for the technical findings the company’s investigation produces.
Source: BleepingComputer — Sony ISP subsidiary data breach exposes 2.5 million customer records
