Sony So-net exposes 2.58 million customer records, including 54,401 email passwords
On October 27, 2026, Sony Network Communications revealed that unauthorized access to its So-net ISP customer database exposed 2,585,481 customer records and 54,401 email addresses along with their passwords. The intrusion dates to October 19 and its cause remains unknown: a reminder of the value of email passwords and of detection lag on database access.
October 27, 2026. Sony Network Communications announces that unauthorized access to its So-net ISP customer database exposed 2,585,481 customer records. October 19, 2026. The intrusion occurred that day, four days before anyone noticed. October 23, 2026. The company confirms the access, stops the affected server, and blocks the connection. The point that matters: among the exposed data are 54,401 email addresses with their passwords — the one element genuinely usable to pivot into other accounts.
What leaked, category by category
Sony’s disclosure is unusually precise, which lets us separate identity from secret. The 2,141,986 So-net records — 1,869,771 active customers plus 272,215 former customers who left after March 2026 — contain name, phone number, email address, user ID, date of birth, gender, and internet connection ID. No passwords appear in this set.
Add 443,495 records from the plala service (S plan), with the same fields and, again, no passwords. The identity records total 2,585,481, with no authentication secret attached.
The secret sits in a separate category. 54,401 email addresses had their passwords exposed, spread across four services: 24,655 free mailboxes from the G mail service (domains gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp), 17,672 A-Box mailboxes, 7,005 VAIO Mail boxes, and 5,069 PostPet accounts. The basic free @*.so-net.ne.jp mailbox is unaffected. Finally, 16 bank-account records and 7 password-reset notification records were exposed. No credit card appears anywhere in the set, and the NURO service is untouched.
Four days between intrusion and detection
The timeline illustrates a recurring problem. The unauthorized access happens on October 19. It is only detected on October 23 — four days later — when the server is stopped and the connection blocked. Confirmation of data exposure does not come until October 24, and public disclosure on October 27.
Four days is a long time for a customer database: long enough to copy 2.5 million records without being noticed. It is also the window SOC teams at ISPs routinely cite as their blind spot — legitimate database access looks too much like illegitimate access for plain logging to tell them apart. The cause of the intrusion remains “under investigation” as of October 29, per the announcement’s update.
The real prize is not identity, it is email passwords
The concrete risk does not come from names and birth dates — largely already public in Japan — but from the 54,401 address-and-password pairs. An email password is a skeleton key: it often serves as the recovery channel for other accounts, and it feeds credential stuffing against every service where the user reused the same secret.
Sony acted accordingly: passwords in the affected category were reset on October 27, and the company advises customers not to respond to suspicious emails, SMS, or calls, and not to open links or attachments. That advice is the implicit admission that the exposed identity data will fuel targeted phishing in the weeks ahead.
Japanese-style disclosure: a model, not an exploit
Sony’s communication deserves a read from Western security leaders. It breaks the incident down by service and by data type, explicitly distinguishes what leaked from what did not (no core passwords, no credit cards), dates each step, and flags the report to the Personal Information Protection Commission — Japan’s regulator, under APPI. No secondary damage is recorded as of October 27.
That granularity is not cosmetic: it tells each customer precisely whether they face identity-theft risk or mailbox-takeover risk. Many companies, in the same situation, publish a single statement that mixes both populations and forces everyone to reset everything.
Verdict
If you run a customer identity store, isolate authentication secrets — email passwords, recovery questions — in a store separate from the nominal database: that is the separation Sony observed without having planned for it, and it capped the damage at 54,401 secrets instead of 2.5 million. If you operate an ISP or a consumer service, measure your database-access detection lag: four days is the number to beat, and it shrinks with anomaly-based access monitoring rather than raw logging. And if you are a So-net customer, reset any passwords you reused elsewhere — the incident is not over until the first round of credential stuffing has run. The lesson fits one line: in a breach this size, the damage is measured not in records but in secrets.