Sony ISP Hack Exposes 2.5 Million Records and Passwords

Four days undetected inside So-net infrastructure

Attackers infiltrated Sony's network on October 19, 2026, operating inside the system until defense teams discovered the breach on October 23.

Sony Network Communications revealed that unauthorized intruders gained access to internal systems powering its So-net internet service provider brand. After discovering the activity, technicians disconnected the compromised server and blocked traffic from the intrusion point, but the response came too late to prevent mass data exfiltration.

A forensic review confirmed the loss of 2,141,986 records tied to current and former So-net subscribers. For 1.8 million active accounts, the stolen files include names, phone numbers, email addresses, dates of birth, genders, customer user IDs, and internet connection identifiers. Core internet access passwords were spared in that general tier, but users of legacy mail services fared far worse.

Exposed email passwords and collateral damage at NTT Docomo

The attack penetrated deeper into several ancillary mailbox services. Sony confirmed that hackers obtained both email addresses and clear text email passwords across 54,401 accounts spanning Email Service (G), A-Box, So-net VAIO Mail, and the legacy PostPet Mail service.

The fallout also extends beyond Sony's direct subscriber rolls. Because major Japanese carrier NTT Docomo relies on Sony Network Communications' underlying network backbones for its plala (S Course) brand, more than 440,000 plala customer records were stolen alongside Sony's own database. NTT Docomo has issued emergency advisories warning its Hikari service users to brace for phishing campaigns and targeted social engineering attempts.

In a tiny fraction of accounts, the data theft included direct financial records. Sony confirmed that attackers exfiltrated the complete banking profiles of 16 customers, detailing financial institution names, branch codes, account types, account numbers, and holder names. The company stated it never stored bank PINs, preventing direct automated cash drainage from those accounts.

Japan's internet service providers face sustained pressure

No criminal collective has claimed responsibility, no ransom demands have surfaced, and none of the exfiltrated databases have appeared on illicit marketplaces. Yet the timing points toward coordinated pressure against Japan's core communications sector.

Less than a week prior, Japanese internet titan GMO Group sounded an extraordinary alarm, instructing customers to scan systems, sever internet connections, and shut down endpoints entirely. When critical infrastructure providers are compromised at the transport layer, consumer vigilance alone cannot plug the gap, creating vulnerabilities akin to finding servers open to remote hijack deep inside enterprise networks.

What it means for international users

The breach strictly targets subscribers to Sony Network Communications' consumer connectivity products in Japan, primarily So-net broadband and associated regional mail servers. Global Sony accounts, including PlayStation Network and Sony Electronics accounts registered in North America, the UK, and Europe, operate on independent authentication systems and remain unaffected.

However, expatriates or international remote workers using So-net home connections or legacy VAIO Mail addresses should immediately cycle passwords on both their Sony mail services and any external platforms sharing identical login credentials.

Sony reported the breach to Japan's Personal Information Protection Commission and law enforcement agencies. With multiple domestic infrastructure operators targeted in back-to-back weeks, the focus now shifts to whether upstream supply chain vulnerabilities exposed these telecom networks.