Sony Data Breach 2026: How Hackers Took 2.58 Million So-net and plala Records

Updated October 30, 2026. This is a live story. Figures come from Sony Network Communications' October 27 notice and FAQ, NTT Docomo and news reports, and may change as Sony's investigation continues.

The Sony data breach of October 2026 hit Sony's Japanese internet provider, not PlayStation. Someone broke into the member database behind So-net, the ISP run by Sony Network Communications, and walked out with up to 2,585,481 customer records: names, phone numbers, email addresses, dates of birth and more. For 54,401 people, working email passwords went too.

The breach also reaches 443,495 people who never signed up with Sony at all. They are NTT Docomo customers on the "plala (S Course)" plan, whose accounts Sony runs behind the scenes. Below is what happened day by day, exactly what leaked, how this compares with Sony's past hacks and Japan's busy month of breaches, and what to do if you have one of these accounts.

Sony data breach 2026: the short version

• Who was hacked: Sony Network Communications, the Sony Group company that runs the So-net internet service in Japan. Its So-net member database was accessed "by a third party" without permission.
• When: The intrusion happened on October 19, 2026. Sony says it spotted it on October 23, confirmed data had leaked on October 24, and went public on October 27.
• How many people: Up to 2,585,481 records: 2,141,986 So-net members and 443,495 plala (S Course) members, current and recently cancelled.
• What leaked: Name, phone number, email address, user ID, date of birth, gender and internet connection ID. Plus 54,401 email passwords, 16 bank account records and 7 password-reset letters.
• What didn't leak: Sony says no credit card data (it doesn't store any), no So-net member login passwords, no bank PINs, and no data from its NURO fibre service.
• PlayStation: PSN is a different Sony business and is not part of this notice. Separate user reports about hijacked PSN accounts are unconfirmed and unrelated as far as anyone has shown.
• Who did it: Unknown. Sony has named no attacker and no one has been credibly linked to the breach yet.

Sony So-net breach timeline

How was Sony hacked?

The honest answer: Sony hasn't said. Its notice describes unauthorized access from outside to the server that holds the So-net member database and says the cause is still under investigation. No hacking group has claimed it in any report we could find, and Sony hasn't said whether ransomware, a stolen login or a software flaw was involved. Here is what is known, step by step.

Step 1: Someone reached the member database (October 19)

So-net's member database is the system that keeps track of who its internet customers are: the contact details, the user IDs people log in with, and the "internet connection ID" a home router uses to get online. On Monday, October 19, an outside party got into the server that holds it.

Step 2: Four days before anyone noticed (October 23)

Sony says it confirmed the unauthorized access on Friday, October 23. It shut the affected server down promptly and blocked communication with the source of the access. Sony hasn't said exactly when in that four-day window the data was copied out, or how much traffic left before the server went dark.

Step 3: Counting what was taken (October 24)

By Saturday, October 24, Sony's investigation had confirmed that personal data had left the building and worked out which fields and how many records. Some outlets, including Beebom, describe October 24 as the day the attackers leaked the data. Sony's own notice doesn't say that; it says October 24 is when it confirmed the leak. We have found no public leak post, so treat the "published by hackers" version as unverified.

Step 4: Passwords reset, customers told (October 27)

On Tuesday, October 27, Sony reset the passwords for every exposed email account, published its notice, opened a dedicated phone line and reported the incident to Japan's Personal Information Protection Commission, the national privacy regulator. NTT Docomo published its own notice the same day for its plala (S Course) customers. On October 29 Sony mailed paper letters to the people whose bank details or reset letters leaked.

What data was exposed in the Sony breach?

This is the part that matters if you are a customer. Sony's notice splits the leak into five buckets.

1. Member records (2,585,481). Every one of these includes name, phone number, email address, user ID, date of birth, gender and internet connection ID. This covers current members and anyone who cancelled in March 2026 or later. If you cancelled by the end of February 2026, Sony says you are not affected. The passwords for these member accounts were not taken.

2. Email passwords (54,401). This is the most dangerous bucket. For four add-on email services, the attackers got the email address and its password:

These people are already counted in the 2.58 million; they aren't extra victims. Sony hasn't said how the passwords were stored, but it treated them as usable: it force-reset all 54,401 on October 27. The regular free mailbox that comes with a So-net membership (the @so-net.ne.jp address) was not affected.

3. Bank account details (16). Bank name and code, branch name and code, account type, account number and account holder name, used for direct debit. Sony says it never held PINs. None of these belong to plala customers.

4. Password-reset letters (7). Data from seven letters Sony had sent members to reset their login. Those passwords have been reset.

5. Not exposed. Credit card data (So-net doesn't store it), So-net member login passwords, and anything from NURO or Sony's other services, according to the notice.

Why Docomo customers are in a Sony breach

Plala is an NTT Docomo internet brand. But one plala plan, "plala (S Course)" for Docomo Hikari fibre customers, runs on accounts inherited from So-net, and its member data sits in the same Sony-run database. That is why 443,495 Docomo customers (422,365 current, 21,130 who cancelled since March) were caught up in it.

Docomo says its other plala plans were not affected. Its own customer notice was published on October 27, and BleepingComputer reports Docomo is also warning about phishing emails that impersonate its d POINT Club and a fake Universal Studios Japan ticket giveaway. Docomo had already announced in June 2026 that plala (S Course) will be folded into its OCN Internet service starting October 2027.

Is PlayStation Network affected?

Based on everything Sony has published, no. So-net and plala are internet-provider services run by Sony Network Communications. PlayStation Network is run by Sony Interactive Entertainment, a different company in the group, and its accounts are not listed anywhere in the notice.

There is a separate, confusing thread. Over the same week, PSN users posted on X that their accounts had been taken over and unknown child accounts added to their family groups, sometimes with two-factor authentication turned on. Help Net Security noted those reports but said Sony Interactive Entertainment had not confirmed a vulnerability or made a statement. Nothing public ties them to the So-net breach. If you're worried, changing your PSN password costs nothing.

How the Sony So-net breach compares

At up to 2.59 million records, this is not Sony's worst day. The 2011 PlayStation Network breach exposed around 77 million accounts and knocked PSN offline for weeks. But it lands in a rough month for Japan: Impress Watch reported a 4.45 million-record leak at the hometown-tax donation site Furusato Choice on October 20, and a breach of up to about 2.6 million Rakuten Travel overseas-booking users on October 26. BleepingComputer adds that Japan's government held urgent meetings on October 26 about its response to the wave of attacks.

Records aren't people, and the leaks contain different things. Furusato Choice's included home addresses and hashed passwords; So-net's included working email passwords for some users. Size is only part of the story.

What should So-net and plala users do now?

Sony says it had seen no secondary harm as of October 27. The realistic risk is targeted scams, because the attackers now hold a name, phone number, email and birthday for millions of people, and those can make a fake message look very real.

• If you used one of the four affected email services, your password has already been reset. Set a new one by going to So-net My Page yourself, typed into the browser, not through a link in a message. Then update the password in any mail app (Outlook, phone mail) that checks that account.
• If you reused that email password anywhere else, change it there now. Reused passwords are how one leak turns into several hacked accounts.
• Treat surprise messages as suspect, especially ones that mention So-net, plala, Docomo, d POINT, refunds, prizes or "account verification". Sony's advice: don't reply, don't tap links, don't open attachments.
• Check your post and My Page. Sony says it is contacting affected customers individually, through My Page notices, email and, for bank-account cases, a paper letter sent October 29.
• If your bank details were among the 16, watch your statements. An account number alone isn't enough to withdraw money, but it helps scammers sound legitimate.
• Questions: So-net's dedicated line is 0120-36-8887 (10:00–18:00 weekdays and Saturdays, plus Sunday November 1 and the November 3 holiday).

Could you spot the follow-up scam?

Breaches like this are usually followed by phishing that uses the stolen details to sound official. Test yourself.

Sony data breach FAQ

Was Sony hacked in 2026?

Yes. Sony Network Communications, the Sony Group company behind the So-net internet service in Japan, says an outsider accessed its So-net member database on October 19, 2026. Up to 2,585,481 records leaked, covering So-net and Docomo's plala (S Course) customers. Sony announced it on October 27 and is still investigating how the attackers got in.

How many people were affected by the So-net breach?

Up to 2,585,481 records: 2,141,986 So-net members and 443,495 plala (S Course) members, including people who cancelled from March 2026 onward. Within that group, 54,401 people also had an email password exposed and 16 had bank account details exposed. Sony's FAQ rounds the total to "up to 2.586 million."

Were passwords leaked in the Sony data breach?

Some were. Passwords for 54,401 accounts on four add-on email services (Mail Service G, A-Box, So-net VAIO Mail and PostPet Mail) leaked, and Sony reset them all on October 27. Sony says the passwords for So-net and plala member logins themselves were not leaked, and neither were passwords for the free basic So-net mailbox.

Is my PlayStation account affected by the Sony breach?

Sony's notice covers So-net and plala only, which are internet-provider services, not PlayStation Network. PSN is run by a different Sony company and isn't mentioned. Some users separately reported hijacked PSN accounts the same week, but Sony hasn't confirmed a PSN problem or linked it to this breach. Changing your PSN password is a cheap precaution.

Was credit card information stolen?

No, according to Sony. So-net doesn't store credit card numbers, so none were in the leaked database. What did leak for 16 customers is direct-debit bank account information: bank and branch, account type, account number and holder name. Sony says it never held PINs, and no plala customers were in that group.

Who hacked Sony's So-net?

Nobody knows yet. Sony describes it only as unauthorized access by a third party and hasn't named a group, a country or a method. We found no credible public claim of responsibility. Japan has seen a wave of large breaches in October 2026, but no report links them to the same attacker.

Why are Docomo customers part of the Sony breach?

Docomo's plala (S Course) plan for Docomo Hikari runs on accounts inherited from So-net, so its member data was stored in the Sony-run database that was breached. That put 443,495 Docomo customers in scope. Docomo says its other plala plans weren't affected and that it will contact affected customers individually.

How do I know if my So-net data was leaked?

Assume you are in scope if you were a So-net or plala (S Course) member at any point from March 2026. Sony is notifying affected customers through My Page notices, email and, in some cases, paper letters. If your email address ends in gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp, an A-Box, VAIO Mail or PostPet address, your email password was reset.

Cleus is an uncensored AI agent that searches the web live, so it can tell you what has changed since this article was written.

Sources

• So-net (Sony Network Communications): Notice of unauthorized access to the So-net member database
• So-net: FAQ on the member information leak
• Sony Network Communications: Press release (PDF, Japanese)
• BleepingComputer: Sony ISP subsidiary data breach exposes 2.5 million customer records
• Help Net Security: Data breach at Sony-owned internet provider compromises 2.6 million customer records
• CyberInsider: Sony discloses data breach exposing 2.6 million customer records
• Impress Watch: So-net leaks about 2.58 million member records in unauthorized access (Japanese)
• Beebom: Sony data breach hits 2.58 million users
• Impress Watch: Rakuten Travel unauthorized access, up to 2.6 million overseas booking records (Japanese)
• Impress Watch: Furusato Choice leaks 4.45 million records (Japanese)
• NTT Docomo: plala (S Course) to be integrated into OCN Internet (Japanese)
• SmartScope: So-net and plala 2.58 million data breach summary
• Wikipedia: 2011 PlayStation Network outage