---
title: Sony Network Communications says attackers got into the So-net member database and took data on about 2.58 million So-net and Docomo plala customers, plus working passwords for 54,401 email addresses | ctxsec
url: https://ctxsec.com/items/sony-so-net-plala-member-database-breach-2-58m
description: ""
status: "confirmed (Sony Network Communications notice and NTT Docomo notice, Oct 27); cause still under investigation"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/sony-so-net-plala-member-database-breach-2-58m.md)

confirmed (Sony Network Communications notice and NTT Docomo notice, Oct 27); cause still under investigation

2026-10-27

### Sony Network Communications says attackers got into the So-net member database and took data on about 2.58 million So-net and Docomo plala customers, plus working passwords for 54,401 email addresses

Sony Network Communications, which runs the Japanese ISP **So-net**, said on Oct 27 that an outside party accessed its member database on **Oct 19**. It spotted the access on Oct 23, shut the server down and blocked the source, and confirmed the data loss on Oct 24.

- **So-net:** 2,141,986 current and recent former members (those who left from March 2026 on). Names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony says login passwords were not taken.
- **Docomo plala (S course):** 443,495 customers of the Docomo Hikari plan that So-net runs for NTT Docomo, with the same fields. Docomo confirmed this in its own notice.
- **Mailbox passwords:** email addresses and their passwords for **54,401** mailboxes on four add-on services (Mail Service (G), A-Box, Sonet VAIO Mail and PostPet Mail). Sony says anyone holding them could read and send mail, so it force-reset those passwords from about 10 AM JST on Oct 27.
- **Other data:** bank account details for 16 customers and 7 password-reset notices. No card data; NURO and other services are not affected.

**What to do:** if you use one of those four mail services, reset the password from the So-net My Page and change it anywhere else you reused it. All affected customers should expect convincing phishing by email, SMS and phone that uses their real name, phone number and birth date. Sony says it has reported the breach to Japan's Personal Information Protection Commission and has seen no secondary damage so far.

Sources: [So-net / Sony Network Communications: Apology and notice about information leak from unauthorized access to the So-net member database (Oct 27, Japanese)](https://www.so-net.ne.jp/info/2026/20261027_0001.html) · [So-net: Q&A on the member database breach (Japanese)](https://www.so-net.ne.jp/support/faq/qa202610_01/) · [NTT Docomo: Notice on leak of Docomo Hikari plala (S course) customer information (Oct 27, Japanese)](https://www.docomo.ne.jp/info/notice/page/261027_05_m.html) · [ITmedia NEWS: So-net leaks about 2.59 million member records (Oct 27, Japanese)](https://www.itmedia.co.jp/news/article/2610/27/2000002643/)