Sony's So-net says 2,585,481 records leaked, 16 with bank account details, and gives no count of people

2,585,481 records, 16 with bank account details, and no count of people

Sony Network Communications, the company behind the So-net internet service in Japan, says in its notice of 27 October 2026 that an outside party accessed its So-net member database on Monday 19 October. The notice lists 2,141,986 So-net records and 443,495 records for plala (S Course), the plala option within Docomo Hikari. They sum to 2,585,481 records (derived). Sony counts records, in the Japanese sense of cases or items, and gives no number of distinct people.

This briefing was read from 18:40 to 18:52 GMT on Wednesday 28 October 2026 from Sony's notice, Sony's questions and answers page, and NTT Docomo's notice for its plala customers. The first two are Sony's own words about its own breach, so every assurance in them is Sony's. Docomo outsources this service to Sony and has its own interest in how the incident reads. The news report that prompted this briefing, BleepingComputer's of 28 October, was read as a pointer only. All Japanese text was read in the original and is translated here by this site.

The opening number needs two cautions straight away. First, 2,585,481 rounds to 2.6 million, not the 2.5 million in the news headline (derived). Sony's questions page says up to 2.586 million (written 258.6 万 in Japanese). Second, the same notice lists three other items outside that sum: 54,401 mail addresses with their mail passwords, 16 bank account records and 7 password reset notice sheets. The bank account records matter because the news report says no banking details were exposed, and Sony's notice says 16 records were.

What the record does not establish is as important as what it does. Sony says the cause is a third party's unauthorised access and that the investigation continues. It does not say how the intruder got in, who it was, when the access ended, how the data was taken, how mail passwords were stored, or whether any of it has been used. As of 27 October neither Sony nor Docomo had confirmed any secondary damage. The sections below set out the dates, the counts, the data, the places where the news report and the notice disagree, and a ranked list of what to do.

Five dates that must not be merged, and three that are missing

The house rule for a breach is to keep the access window, discovery, containment, notification and publication dates apart. Sony's notice gives the first three of those as separate days, and Docomo and Sony's own release feed add two more. All dates are Japan time. The day numbers count from 19 October and are derived.

Read the table for what it does not say. Sony states a date on which access occurred, 19 October. It does not state a date on which access stopped. The news report writes that the breach occurred on 19 October and was detected four days later, which fits the notice's dates, but the notice describes the 19th as the day the database received access, not as the whole access window. The window between 19 and 23 October is at most four days (derived) and could be shorter, and the notice does not say.

Zoom

Two intervals deserve a flag. The mail passwords were reset on 27 October, four days after Sony stopped the servers and eight days after the stated access date (derived). Sony's questions page explains why it forced the reset without warning: with the leaked address and password, the third party could read and send mail through a mail program or webmail. That is Sony's own statement of capability. The record does not say whether any mailbox was opened in those days, and Sony does not say whether it can tell.

Counting records, mail addresses and people

Sony's notice gives its counts in blocks, and each can be checked by addition. The So-net block is 1,869,771 current members plus 272,215 former members who left in March 2026 or later, which is 2,141,986 (derived and matching the notice). The plala block is 422,365 current plus 21,130 former, which is 443,495 (derived and matching). The two blocks sum to 2,585,481 (derived). Sony states that nobody who left by the end of February 2026 is included.

Zoom

Zoom

Counts are records, and a record is not a person. The notice does not say whether one person who held both a So-net and a plala service appears twice, whether a household with one contract appears once for several people, or how many different people the former and current records cover. Docomo calls its plala figure 443,495 records of information about current customers and those who cancelled within six months. Sony says the former members are those who left from March 2026, which is about eight months before the notice (240 days from 1 March to 27 October, derived), not six. The two statements are not the same, and neither explains the gap.

Zoom

The mail list is the one to read twice. Sony says passwords were leaked for 54,401 addresses on four mail services: 24,655 on the free Mail Service (G), 17,672 on the paid A-Box, 7,005 on Sony VAIO mail and 5,069 on PostPet mail. They add up to 54,401 (derived). That is 2.5 per cent of the So-net member records (derived), which is a small share and also the part with the highest consequence, because a mailbox password opens messages and password reset links. Sony's notice describes these addresses as belonging to current and former So-net members. That suggests they are already inside the 2,141,986, so they are not added to the total here, but the notice does not say so.

A last count concerns who is in the data at all. Former members are 293,345 of the 2,585,481 records, or 11.3 per cent (derived). Sony's questions page says it keeps information after cancellation for a period, for the final month's bill and for enquiries, and does not name the period. The notice does not explain why records from March 2026 are present while earlier ones are not.

What leaked, and what Sony says did not

The table below follows Sony's notice and questions page. Each row has a column for what Sony says was not taken. Those entries are Sony's assurances, not independent checks, and the questions page words some of them as the absence of confirmation, not the absence of a leak.

The profile fields are the kind that make a convincing phone call or email: a name, a number, a date of birth and the email address together. The user ID is the My Page login name, and Sony says the matching password was not taken, so it is half of a credential pair. Docomo's notice lists the same fields for plala customers, adds a contact email address where registered, and says the email addresses in scope are only those in the so-net.ne.jp domain. Both companies tell customers to ignore unexpected email, SMS and calls and not to open links or attachments, which follows from the fields leaked (inference).

BleepingComputer links the leak to a phishing campaign Docomo warned about on the same day, which imitates a points club and a theme park ticket draw. Docomo's separate warning was read in full. It describes the fake emails and sites and does not mention Sony, So-net, plala or any data leak. Docomo's breach notice, for its part, warns of suspicious contact in general. So the link between the two is the report's juxtaposition, not either company's statement. No evidence connects the two on the record.

The friendly name check applies to the word password. Sony's notice says no password leaked in the member records, and in the same notice 54,401 mail passwords leaked. Both statements are true because they are about different passwords. A customer who reads the first and stops reads the wrong answer. Credit cards are different again: Sony says it does not hold them, which is a design choice that works as a control, not a finding about this attack. The same applies to the account PIN. Neither tells the 16 account holders what a criminal can do with an institution, branch, account number and holder name, which is information a fraudster could use to impersonate the holder to a bank. That is inference, labelled as such, and Sony does not say it has seen any such use.

Where the news report and the notice disagree

BleepingComputer's report of 28 October 2026 is accurate on the main outline, and it credits Sony's announcement. Set beside the notice, four statements need correcting or qualifying. Its author is not named here because the point is the statement, not the person.

The difference that matters most is the bank account line. A reader who relied on the headline summary would conclude nothing financial was involved. The notice says 16 account records were, with the fields listed, and promises individual contact. Sixteen records in 2,585,481 is about six in a million (derived), and for those 16 people it is the whole story. A small count in a large breach is a reason for a separate notice, not a reason to leave it out.

Stated and not stated

The notice and the questions page differ on one point of substance. The notice says personal information leaked and lists the items as leaked. The questions page says a leak of customers' personal information is highly likely and that up to 2.586 million records may have leaked, while keeping a confirmed leak for the mail passwords. Whether the profile fields were taken or only exposed to taking is the open point. The notice's own date line, 24 October, says the leak was recognised and the counts known.

For context only: on 11 July 2025 the same company announced that a third party had used stolen user IDs and passwords to change some customers' So-net email addresses. ScanNetSecurity's report says Sony found no leak of customer IDs or passwords from its own systems at that time. ScanNetSecurity's headline calls that a password list attack. This October event is described as unauthorised access to a member database. Nothing in the record connects the two.

The regulator, briefly

Sony says it reported the incident to Japan's Personal Information Protection Commission. The PPC's reporting page says to report promptly after discovery, and within 60 days of discovery where the incident may have been committed with a wrongful aim. It lists the cases that require a report, including unauthorised access that takes personal data from a server, and any leak affecting more than 1,000 people. The page is general guidance and does not mention this incident. No PPC statement about it was seen, so the record is Sony's word that it filed, with no date.

Technical details

Neither Sony nor Docomo prints an indicator of compromise: no address, domain, file name, hash, tool name, vulnerability identifier or log line. The only artifacts the primaries publish are the dates, the list of leaked fields, and the pattern of mail addresses on the four services whose passwords leaked. They are copied below exactly as printed, so a defender can match them against an identity export or a mail log. The English is this site's translation.

The first block is Sony's list of leaked profile fields, from its questions page. In English: name, phone number, email address, user ID, date of birth, connection ID used for internet access, and gender.

氏名、電話番号、メールアドレス、ユーザーID、生年月日、インターネット接続に使用する接続用ID、性別

The second block is the four mail services whose address and mail password leaked, with the address patterns, price class and count, as printed in Sony's notice. The three asterisks stand for a subdomain string. A defender can use the patterns to find staff or customer accounts that use these addresses.

メールサービス（G）  @***.gyao.ne.jp / @***.gate01.com / @***.pbc.ne.jp / @***.highway.ne.jp  無料  24,655
A-Box（追加メールボックス）  @***.so-net.ne.jp  有料  17,672
ソネット VAIO メール  @***.vaio.ne.jp  有料  7,005
PostPet メールアカウントサービス  @postpet***.so-net.ne.jp  有料  5,069

The third block is the notice's own account of the dates, in the order Sony printed them. It is the nearest thing the primaries offer to a log.

2026 年 10 月 19 日(月) So-net 会員データベースに対して外部から不正アクセスを受けました。
2026 年 10 月 23 日(金) 同アクセスがあったことを確認しました。
2026 年 10 月 24 日(土) 調査の結果、不正アクセスにより個人情報の漏洩が認められ、その項目および件数を把握しました。

What to hunt, derived from the notices and not from any indicator: logins and message reads on any mailbox on the domains above from 19 October 2026 onward, mail rules or forwarding added since then, and password reset emails sent to those addresses for third party accounts. Anything that asks a customer for a login, a code or a payment, and cites a Sony, So-net or Docomo incident, should be reported to the service desk first. Sony names no malware, no tool and no technique, so a detection rule cannot be written from this record, and none is offered here.

What to do, in order

The list serves three groups: people with a So-net, plala or Docomo Hikari service, organisations whose staff or customers use these addresses, and any operator that holds a member database. It uses only what the notices say and the derivations above.

How this was read, and what was not

Read in full from the original: Sony Network Communications' notice (a three page PDF dated 27 October 2026), its questions page, Docomo's two notices of 27 October (the plala breach notice and the separate phishing warning), and the PPC's reporting page. Sony's release feed was read for the 16:00 JST time stamp on the notice. BleepingComputer's page was read as a pointer. ScanNetSecurity's 2025 report was read for the earlier incident only.

Not read: The Japan Times report that BleepingComputer links, because the site answered with a bot check and this briefing does not get past one; and Sony's own 2026 release listing page, which did the same. No PPC filing, police report, forensic report or independent account was found. A few web searches for further reporting in English and Japanese found nothing on this incident. Everything about the cause is therefore Sony's, and nothing about the leak has been independently verified.

The question the notice leaves open

Sony's notice counts 2,585,481 records, names a date on which the access began, and says the mail passwords of 54,401 addresses were in a third party's hands until they were reset eight days later (derived from the stated dates). If the data of 2,585,481 records cannot yet be turned into a number of people, and the mail logs are the only way to tell whether any of those 54,401 mailboxes were opened, who has checked those logs, and what did they find?

Key facts