So-net Review: 2.58 Million Records Exposed in October 2026 Breach

So-net, operated by Sony Network Communications, confirmed unauthorized access to its member database that began on October 19, 2026. Investigators detected the intrusion on October 23, isolated the affected server, and blocked the attacker the same day. Data exfiltration was verified on October 24.

The incident impacted 2,585,481 records in total. So-net accounted for 2,141,986 records, while plala S course contributed 443,495. Current members formed the majority, with 1,869,771 active So-net accounts and 422,365 active plala accounts affected. Former members who canceled after March 2026 were also included, while those who left by February 2026 remained unaffected.

So-net Data Breach Scope and Leaked Information

Leaked fields included name, phone number, email address, user ID, date of birth, gender, and internet connection ID for both So-net and plala customers. Member passwords and credit card details were not exposed. Four So-net email services saw 54,401 email addresses and associated send/receive passwords compromised; the company reset those passwords on October 27. Bank account details appeared in 16 So-net records, and seven password-reset notification records were also taken.

plala S course operates as a Docomo Hikari fiber plan managed through the So-net database. Other plala and Docomo services stayed outside the breach scope. NTT Docomo received notification on October 26 and issued its own statement confirming the limited impact.

The company reported the incident to Japan’s Personal Information Protection Commission. Cause investigation continues, with reoccurrence prevention measures planned. Dedicated hotlines opened for affected users: 0120-36-8887 for So-net and 0120-035-700 for plala-specific inquiries.

Sony Network Communications Security Response and User Implications

Sony Network Communications and Docomo issued apologies for the inconvenience and concern. As of October 27, no secondary harm had been identified. The firms advised customers to watch for suspicious contacts, links, or files and committed to ongoing monitoring, individual notifications, and a full security review.

Users should verify any unexpected communications claiming to come from So-net or plala. Password resets for the affected email services provide one immediate safeguard. Monitoring credit reports and account activity remains advisable while the investigation proceeds.

The breach highlights typical risks in shared database environments between telecom providers and their partners. Affected customers can expect direct contact once individual notifications begin. Until then, the published hotlines and FAQ pages on the official sites supply the primary channels for status updates.