Data breach at Sony ISP subsidiary exposes 2.5 million customer records as Japan hit with another major cyberattack

Sony Network Communications discloses breach affecting roughly 2.5 million ISP customers and former users Exposed data included personal details, while some email service users also lost email passwords Company contained the intrusion, notified authorities, and warned customers about phishing and fr

<![CDATA[ <article> <ul><li><strong>Sony Network Communications discloses breach affecting roughly 2.5 million ISP customers and former users</strong></li><li><strong>Exposed data included personal details, while some email service users also lost email passwords</strong></li><li><strong>Company contained the intrusion, notified authorities, and warned customers about phishing and fraud risks</strong></li></ul><p>A subsidiary of Sony Network Communications, the Japanese tech giant’s Internet Service Provider (ISP) arm, has confirmed suffering a data breach which saw it lose sensitive data on roughly 2.5 million people. </p><p>Among the stolen files were people’s phone numbers, email addresses, and in some cases - email <a href="https://www.techradar.com/best/password-manager" target="_blank">passwords</a>. </p><p>The company confirmed the news in an apology and notice letter in which it said threat actors accessed So-net, the company’s consumer-facing ISP service brand. The identity of the attackers was not disclosed, and nor was the method they used to break in. The breach happened on Monday, October 19 2026, and was spotted four days later, on October 23. </p><p>“Immediately after confirming the incident, we shut down the affected server and blocked communications from the source of the unauthorized access,” the machine-translated letter reads. A day later, the investigation determined that the attackers exfiltrated a total of 2,141,986 sensitive records belonging to both current and former members. </p><h2 id="trickling-down-to-ntt-docomo">Trickling down to NTT Docomo</h2><p>Of that number, roughly 1.8 million belong to current members, who had their names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs exposed to the hackers. Passwords were not leaked, Sony said. </p><p>There were also more than 440,000 records taken from plala (S Course), and this part also affects NTT Docomo, a separate internet service provider that uses Sony Network Communications’ underlying infrastructure as part of its service.</p><p>NTT Docomo issued a separate statement, notifying its customers of the incident, and urging them to stay vigilant with incoming emails and other communications: </p><p>“There is a risk of suspicious communications from those who misuse potentially leaked information in the future,” the machine-translated notice reads. “Please pay attention to the following points: </p><p>・Do not respond to emails, SMS, or phone calls</p><p>・Do not open links in the body</p><p>・Do not open attached files.”</p><p>The company added that the incident affects all Hikari service clients, as well as those that cancelled from May 2026, onwards.</p><p>Some So-net members’ email addresses and email passwords were, indeed, taken. A separate set of data affecting Email Service (G), A-Box (an additional mailbox service), So-net VAIO Mail, and PostPet Mail Account Service was nabbed, and the company reported 24,655 affected addresses for Email Service (G), 17,672 for A-Box, 7,005 for So-net VAIO Mail, and 5,069 for PostPet Mail Account Service. The breach affects both current So-net customers, and those that cancelled their subscriptions in March 2026 or later. Those that cancelled by the end of February were not affected, according to the announcement. </p><h2 id="banking-data-struck-too">Banking data struck, too</h2><p>Some customers also had their banking data exposed - but not many. “We confirmed the leakage of 16 records containing bank account information, including financial institution name, bank code, branch name, branch code, deposit account type, account number, and account holder's name,” the company said. </p><p>It stressed that it does not hold bank account PINs and therefore, they could not have been compromised. “We will individually contact the affected customers to apologize,” the notice reads.</p><p>Sony Network Communications said it notified the country’s Personal Information Protection Commission and other relevant government and law enforcement organizations and is currently investigating the attack. </p><p>So far, no hacking groups have claimed responsibility for the attack, and the data has not yet appeared anywhere on the dark web. There is also no word of this being an extortion attempt.</p><p>The attack comes less than a week after Japanese internet giant <a href="https://www.techradar.com/pro/security/japanese-internet-giant-gmo-tells-customers-to-shut-down-and-disconnect-pcs-from-the-internet-following-data-breach-and-ransomware-threat" target="_blank">GMO Group</a> told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down. </p><p><em>Via </em><a href="https://www.bleepingcomputer.com/news/security/sony-isp-subsidiary-data-breach-exposes-25-million-customer-records/" target="_blank"><em>BleepingComputer</em></a></p> </article> ]]>