The Sony data breach disclosed on 27 October 2026 exposed 2,585,481 member records from the Japanese internet providers So-net and plala. Sony Network Communications says names, phone numbers, dates of birth and email addresses were taken, along with 54,401 email passwords and 16 bank account records. No credit card data was involved.
What Was Taken, and From How Many
The alarming data types in this breach affected a small fraction of the people in it, and the harmless-sounding ones affected nearly everybody. Sony’s own notice gives the split:
| Data exposed | Records | Who |
|---|---|---|
| Name, phone number, email address, user ID, date of birth, gender, connection ID | 2,585,481 | All affected So-net and plala members |
| Email address plus email password | 54,401 | Users of four So-net email services |
| Bank account details | 16 | So-net members only |
| Password-reset notification records | 7 | So-net members only |
| Credit card data | 0 | Nobody |
Sony states plainly that membership passwords were not involved: “No passwords were leaked” for the So-net and plala account records themselves. The 54,401 figure is a separate pool of email service credentials, and those users were already counted in the 2,585,481 total rather than being additional customers.
The 16 bank account records are the most sensitive item and the narrowest. Sony says they include the institution name, bank code, branch name and code, account type, account number and holder name. It adds that it does not store account PINs, and that no plala customer was affected by this part of the leak.
Scale cuts the other way for the basic fields. A set of 2.58 million verified names, dates of birth, phone numbers and email addresses tied to a known internet provider is exactly what makes a convincing fake billing message, which is why Sony’s warning focuses on suspicious contact rather than on fraud already committed.
Who Is Affected, Including Docomo Hikari Subscribers
Many of the affected customers have never seen the word “plala” on a bill. The 443,495 plala (S Course) records belong to subscribers of NTT Docomo’s Docomo Hikari fibre service, which runs on an infrastructure contract with Sony Network Communications.
- So-net members: 2,141,986 records, made up of 1,869,771 current members and 272,215 former members.
- plala (S Course) members: 443,495 records, made up of 422,365 current members and 21,130 former members.
- Former members: only those who cancelled in March 2026 or later are in the data. Accounts closed on or before 28 February 2026 were not affected.
NTT Docomo published its own confirmation of the 443,495 figure after Sony Network Communications reported the incident to it on 26 October, according to Impress Watch’s Ketai Watch. Docomo says other plala plans and other Docomo Hikari plans were not caught in the leak.
Which Sony Services Were Not Affected
This is not a PlayStation breach, and it is not Sony’s larger consumer fibre brand either. Sony’s notice says it has found no leak from NURO, its high-speed fibre service, or from any service not named in the disclosure.
The four email services whose passwords were exposed are narrower still, and Sony lists them individually:
- Mail Service (G), free: 24,655 addresses, covering the gyao.ne.jp, gate01.com, pbc.ne.jp and highway.ne.jp domains.
- A-Box additional mailbox, paid: 17,672 addresses.
- So-net VAIO Mail, paid: 7,005 addresses.
- PostPet Mail Account Service, paid: 5,069 addresses.
If you do not hold an address on one of those four services, your email password was not in this breach even if your membership record was.
What Sony Has Done So Far
- Monday 19 October 2026: an outside party gained unauthorised access to the So-net member database.
- Friday 23 October 2026: Sony confirmed the access, shut down the affected server and cut off the attacker’s connection.
- Saturday 24 October 2026: the investigation established that personal data had been taken and identified the fields and record counts.
- Monday 26 October 2026: Sony Network Communications reported the incident to NTT Docomo.
- Tuesday 27 October 2026: Sony published the disclosure, force-reset the 54,401 email passwords, reported the breach to Japan’s Personal Information Protection Commission, and opened an FAQ page and a dedicated phone line.
As of 27 October 2026, Sony says it has confirmed no secondary damage arising from the incident. The cause is listed in its notice as third-party unauthorised access, still under investigation, and Sony has not said how the attacker got in or how the email passwords were stored.
The four days between intrusion and detection, and the eight between intrusion and public disclosure, are shorter than in several recent cases. Capcom took far longer to quantify a comparable incident, as our report on the Capcom data breach set out, and the figure in the IDC Frontier ransomware case was still only a stated maximum weeks later.
What to Do if You Had a So-net or plala Account
- Reset your email password through My Page: if you use Mail Service (G), A-Box, So-net VAIO Mail or PostPet, Sony has already invalidated the old password and you must set a new one to send or receive mail.
- Type the address yourself: go to So-net’s site directly rather than through a link in any message, since the leaked data makes a convincing reset email easy to fake.
- Change the password anywhere you reused it: Sony reset the password on its own services only.
- Treat unexpected contact as suspect: Sony asks customers not to answer suspicious emails, text messages or calls, and not to open their links or attachments.
- Check statements if you paid by direct debit: only 16 account records were taken, but Sony is contacting those customers, and bank details cannot be changed as easily as a password.
Sony Data Breach FAQ
Was PlayStation Network Caught in the Sony Data Breach?
No. The breach hit the So-net member database operated by Sony Network Communications, the group’s Japanese internet provider. Sony’s notice names no PlayStation service.
Were Credit Card Numbers Leaked?
No. Sony states that credit card information is not included in the leaked data. Sixteen bank account records were exposed, and Sony says it does not hold the PINs for them.
How Do I Know if I Am One of the 443,495 Docomo Hikari Customers?
The affected plan is plala (S Course), supplied through Docomo Hikari. NTT Docomo says other plala and Docomo Hikari plans were not affected, and it is contacting those who were.
I Cancelled My So-net Account Last Year. Am I Affected?
Only cancellations from March 2026 onward are in the data. Accounts that ended on or before 28 February 2026 were not included.
Has Anyone Been Defrauded Using This Data?
Sony said on 27 October 2026 that it had confirmed no secondary damage. It warns that the data could be used for fraudulent emails, messages and phone calls, and its investigation continues.
