Data breach at Sony’s ISP subsidiary exposes 2.5 million customer records as Japan suffers another major cyberattack
follow us
Add us as a preferred source on Google
- Sony Network Communications Reveals Breach Affecting Approximately 2.5 Million ISP Customers and Former Users
- The exposed data included personal data, while some users of the email service also lost their email passwords.
- The company contained the intrusion, notified authorities and warned customers about the risks of phishing and fraud.
A subsidiary of Sony Network Communications, the Internet service provider (ISP) division of the Japanese technology giant, confirmed that it suffered a data breach that resulted in the loss of confidential data of approximately 2.5 million people.
Among the stolen files were people’s phone numbers, email addresses and, in some cases, email passwords.
The company confirmed the news in an apology and advisory letter saying that threat actors accessed So-net, the company’s brand of consumer-facing ISP services. The identity of the attackers was not revealed, nor was the method they used to enter. The violation occurred on Monday, October 19, 2026 and was detected four days later, on October 23.
Latest videos ofTechnologyRadar
“Immediately upon confirming the incident, we shut down the affected server and blocked communications from the source of the unauthorized access,” the automatically translated letter reads. A day later, the investigation determined that the attackers exfiltrated a total of 2,141,986 confidential records belonging to current and former members.
Coming to NTT Docomo
Of that number, approximately 1.8 million belong to current members, whose names, phone numbers, email addresses, user IDs, dates of birth, genders, and Internet connection IDs were exposed to hackers. The passwords were not leaked, Sony said.
More than 440,000 plala (Course S) records were also taken, and this part also affects NTT Docomo, an independent Internet service provider that uses the underlying infrastructure of Sony Network Communications as part of its service.
NTT Docomo issued a separate statement, notifying its customers of the incident and urging them to remain attentive to incoming emails and other communications:
“There is a risk of future suspicious communications from those who misuse potentially leaked information,” the automatically translated notice reads. “Please pay attention to the following points:
・Do not respond to emails, SMS or phone calls
・Do not open links in the body.
・Do not open attachments.”
The company added that the incident affects all Hikari service customers, as well as those who canceled from May 2026 onwards.
In fact, the email addresses and passwords of some So-net members were taken. A separate set of data affecting the Email (G) service, A-Box (an additional mailbox service), So-net VAIO Mail, and the PostPet mail account service was detected, with the company reporting 24,655 affected addresses for the Email (G) service, 17,672 for A-Box, 7,005 for So-net VAIO Mail, and 5,069 for the PostPet mail account service. The breach affects both current So-net customers and those who canceled their subscriptions in March 2026 or later. Those who canceled in late February were not affected, according to the announcement.
Banking details are also affected
Some customers also had their banking details exposed, but not many. “We confirm the leak of 16 records containing bank account information, including the financial institution name, bank code, branch name, branch code, deposit account type, account number, and account holder name,” the company said.
He stressed that he does not have bank account PINs and, therefore, they could not have been compromised. “We will contact affected customers individually to apologize,” the notice says.
Sony Network Communications said it has notified the country’s Personal Information Protection Commission and other relevant government and law enforcement organizations and is currently investigating the attack.
So far, no hacking group has claimed responsibility for the attack and the data has yet to appear anywhere on the dark web. There is also no news that this is an extortion attempt.
The attack comes less than a week after Japanese Internet giant GMO Group told its customers to scan their computers for viruses, back up all their data, disconnect devices from the Internet and then turn them off.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment