Sony ISP Subsidiary Data Breach Exposes 2.5 Million Customer Records

What happened

On October 19, 2026, Sony Network Communications, a subsidiary of Sony Group Corporation that operates the So-net ISP service in Japan, discovered unauthorized access to its member database. The breach was identified four days later, when the company shut down the affected servers and blocked external traffic to contain the incident.

Investigations confirmed that the attacker extracted 2,585,481 customer records from the So-net member database. The company released a statement on October 28 indicating that the data dump was made available to the attacker before the shutdown.

Who is affected

The compromised data set includes current and former So-net customers across Japan. The records cover a broad customer base, encompassing residential and business subscribers who rely on Sony Network Communications for internet access.

In addition to the primary database, an ancillary leak exposed 54,401 email addresses from various email services, many of which were accompanied by stored passwords. Users of those email services are also at risk.

Impact

While no financial or payment information was reported as part of the breach, the exposed personal data can facilitate identity‑theft attacks. Attackers can use the information to craft targeted phishing campaigns or to bypass authentication mechanisms that rely on personal identifiers.

Because the breach involved a large volume of records, the potential for widespread credential stuffing and social‑engineering attacks is significant. Organizations that provide services to So-net customers should be aware of the heightened risk.

Exposure

The exposed fields include full names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection identifiers. No banking, credit card, or other payment details were found in the dataset.

Additionally, the 54,401 email addresses from third‑party providers were leaked with associated passwords. Those credentials were stored in plain text, making them immediately usable by attackers.

What to do

• Force password resets for all So-net accounts and any accounts that use the leaked email addresses.
• Enable or enforce multi‑factor authentication for all customer portals and administrative interfaces.
• Monitor authentication logs for unusual sign‑in patterns, especially from unfamiliar IP ranges.
• Notify affected customers via email and SMS, advising them to change passwords and watch for phishing attempts.
• Conduct a security review of the So-net member database to ensure proper access controls and encryption at rest.
• Implement continuous monitoring for credential‑stuffing attacks using threat‑intel feeds.

What to watch

Security teams should keep an eye on emerging phishing campaigns that target Sony Network Communications customers. Attackers may use the leaked data to create convincing spear‑phishing emails that reference personal details.

Additionally, monitor for any new vulnerabilities in the So-net platform that could allow attackers to re‑enter the system. Regular patching and vulnerability scanning are essential to prevent a repeat of the incident.