Sony Network Communications, a Japanese subsidiary of Sony Group, has confirmed a data breach that exposed personal information held in approximately 2.5 million customer records. The company said an unauthorized party accessed its So-net member database on October 19, four days before the breach was detected and the affected servers were shut down.
Sony Network Communications, the Sony Group subsidiary that provides telecommunications and internet services in Japan, said the breach affected the database supporting its So-net internet access service. An investigation confirmed that 2,585,481 customer records were exposed, including full names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. No banking, payment card or other account details were exposed.
An additional 54,401 email addresses from several email services were exposed along with account passwords. Sony advised users to change their passwords.
The exposed records include 2,141,986 So-net entries and 443,495 plala (S Course) records. The plala records relate to NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services. NTT Docomo notified customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign, falsely claiming that recipients had won and prompting them to enter personal information to claim tickets. Docomo said the incident affects all current Hikari service clients and those who canceled within the preceding six months.
Sony reported the incident to Japan's Personal Information Protection Commission and is investigating its cause and scope. As of October 27, neither company had confirmed misuse of the exposed data in the wild.
The breach follows a series of cyberattacks on Japanese companies this year. KDDI suffered a breach affecting 12 million customers, IDC Frontier was targeted by ransomware, and NTT was hit in early 2025 by hackers who gained access to its systems and stole the data of 18,000 corporate customers. GMO Internet Group's Onamae Desktop Cloud service also suffered a widespread malware attack on customer servers. The recent rate of breaches prompted the Japanese government to hold urgent meetings on Monday to plan its response.
Analysis
Why This Matters
- The breach exposes personal data of roughly 2.5 million current and former customers of Sony's Japanese ISP, raising the risk of phishing and identity theft.
- It is part of a wave of cyberattacks on Japanese telecommunications and technology providers that has prompted urgent government planning.
- NTT Docomo's Hikari customers are also affected through the company's contract with Sony Network Communications.
Background
Japan has seen multiple high-profile cyberattacks this year. Telecommunications giant KDDI suffered a breach affecting 12 million customers, IDC Frontier was hit by ransomware, and NTT was attacked in early 2025, with hackers stealing the data of 18,000 corporate customers. GMO Internet Group's Onamae Desktop Cloud service also suffered a widespread malware attack on customer servers. The pace of recent breaches led the Japanese government to hold urgent meetings on Monday to plan its response.
Key Perspectives
- Sony Network Communications: Confirmed the breach, said it shut down the affected servers, and is investigating the cause and scope. It advises users to change their passwords.
- NTT Docomo: Notified customers of the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign.
What to Watch
- Whether either company confirms misuse of the exposed data, which had not been reported as of October 27.
- The outcome of Sony's investigation and any findings from Japan's Personal Information Protection Commission.
- Whether the Japanese government's urgent response leads to new requirements or guidance for affected providers.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe breach exposed approximately 2.5 million customer records.BleepingComputer: “Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information.”
- SupportedSony Network Communications confirmed the data breach.BleepingComputer: “Sony Network Communications has confirmed a data breach”
- SupportedThe breach occurred on October 19 and was detected four days later, when the company shut down the compromised servers.BleepingComputer: “The breach occurred on October 19 and was detected four days later, when the company shut down the compromised servers and blocked external communication.”
- Partly supportedSony Network Communications is a Japanese subsidiary of Sony Group.BleepingComputer: “A Sony Group Corporation subsidiary, the company provides telecommunications and technology services, acting as an internet service provider (ISP) in Japan.”
- SupportedAn unauthorized party accessed the So-net member database.BleepingComputer: “the company said that its So-net member database, supporting its internet access service, was accessed by an unauthorized party.”
- SupportedThe exposed records included names, phone numbers, email addresses, user IDs, dates of birth, gender and Internet Connection IDs.BleepingComputer: “including the following types of information: Full names Phone numbers Email addresses User IDs Dates of birth Gender Internet Connection IDs”
- SupportedNo banking, payment card or other account details were exposed.BleepingComputer: “No banking, payment card, or other account details were exposed.”
- SupportedAn additional 54,401 email addresses from several email services were exposed along with account passwords.BleepingComputer: “An additional 54,401 email addresses from several email services were also exposed along with account passwords.”
- SupportedThe exposed records included 2,141,986 So-net entries and 443,495 plala (S Course) records.BleepingComputer: “there are 2,141,986 So-net entries and 443,495 plala (S Course) records.”
- SupportedNTT Docomo warned customers about phishing emails and fake websites impersonating d POINT Club and a Universal Studios Japan campaign.BleepingComputer: “NTT Docomo also notified customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan (USJ) campaign”
- SupportedDocomo said the incident affects all current Hikari service clients and people who canceled within the preceding six months.BleepingComputer: “Docomo says the incident affects all current Hikari service clients and those who canceled within the preceding six months.”
- SupportedAs of October 27, neither company had confirmed misuse of the exposed data in the wild.BleepingComputer: “As of October 27, neither company had confirmed misuse of the exposed data in the wild.”