If you have a So-net or plala (S Course) account, assume your name, phone number, email address, date of birth and user ID were stolen. Sony Network Communications confirmed on October 27, 2026 that attackers copied about 2.58 million member records. Card numbers were not taken, so the main risks are phishing and scam calls: reset your password and ignore unexpected "So-net" messages.
What Happened in the So-net Breach
Sony Network Communications, the Sony Group subsidiary that runs the So-net internet service in Japan, says an unauthorized third party broke into its So-net member database. Here is the timeline from the company's disclosure:
- October 19, 2026: attackers accessed the So-net member database
- October 23: Sony confirmed the intrusion and shut down the affected server
- October 24: the investigation confirmed personal data had leaked and identified which records
- October 27: Sony published its notice, reset the exposed email passwords, and reported the incident to Japan's Personal Information Protection Commission
The investigation is ongoing, and as of October 27 neither Sony nor its partners had confirmed any misuse of the stolen data. The breach lands in the middle of a wave of Japanese incidents, including the KDDI data breach and recent disclosures at Capcom, Nikkei and Burger King Japan.
Who Is Affected
The 2,585,481 records break down into two groups:
- So-net: 2,141,986 records — 1,869,771 current members plus 272,215 people who left the service in March 2026 or later
- plala (S Course): 443,495 records, including 21,130 former members. Sony runs this service for NTT Docomo, which says all current Docomo Hikari customers on that service, plus those who cancelled in the previous six months, are affected
Customers who cancelled So-net by the end of February 2026 are not affected. Sony says it found no leak from NURO fiber or its other services.
What Data Was Exposed
The stolen membership records contain:
- Full names
- Phone numbers and email addresses
- So-net user IDs and internet connection IDs
- Dates of birth and gender
Two smaller groups had more sensitive data taken:
- 54,401 email accounts had both the address and the password exposed — 24,655 on the free Mail Service (G) and the rest on the paid A-Box, So-net VAIO Mail and PostPet Mail services. Sony has reset those passwords.
- 16 records included bank name, branch, account type, account number and account holder name.
Sony says membership passwords and credit card numbers were not included, and it does not store account PINs.
Expect Targeted Phishing
A real name, phone number, birth date and user ID is exactly what a scammer needs to sound like So-net or Docomo support. Docomo has already warned about fake emails and websites impersonating its d POINT Club and a Universal Studios Japan prize campaign. Treat any message about a refund, prize or "account verification" as fake until you confirm it through the official site.
Step 1: Reset Your Email Password Through My Page
If you use a So-net mailbox, sign in to So-net My Page by typing the address yourself and set a new, unique password. If you were one of the 54,401 users whose mail password leaked, Sony has already reset it, so you must create a new one before you can sign in. If you reused that password on any other site, change it there too — attackers test leaked email and password pairs against banks, shopping sites and game accounts within days.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 2: Turn On Two-Factor Authentication
Enable two-factor authentication on your main email, banking and shopping accounts, especially any registered to your So-net address. An authenticator app is safer than SMS codes because your phone number was also exposed. Our guide to setting up two-factor authentication walks through the major services.
Step 3: Ignore Unexpected "So-net" and "Docomo" Messages
Sony says it will contact affected customers individually and has opened a dedicated phone line and FAQ page. Anything else claiming to be from So-net, plala or Docomo deserves suspicion:
- Do not click links or open attachments in unexpected emails or texts
- Hang up on callers asking you to confirm your user ID, birth date or bank details, then call the number on the official website
- Never pay a "fee" to receive compensation or a prize
For a refresher on the red flags, see how to recognize phishing scams.
Step 4: Watch Your Bank Account If You Were in the 16
If Sony tells you your bank details were among the 16 exposed records, alert your bank, ask about extra verification on your account, and review statements closely for the next few months. Bank account numbers alone are rarely enough to withdraw money, but they make impersonation calls far more convincing.
Step 5: Shrink the Rest of Your Exposed Data
Breach data rarely stays in one place. Criminals combine leaked records with profiles from people-search sites and data brokers to add home addresses, relatives and past phone numbers. If your email address was in the leak, check whether it also appears in other breaches, and if you think the account was misused, follow our guide on what to do if your email is hacked.
How PrivacyOn Helps After a Breach
PrivacyOn monitors the dark web for your email addresses and phone numbers and alerts you when they show up in a new leak. It also removes your personal details from 100+ data broker and people-search sites, so attackers have less to add to stolen records. Plans start at $8.33/month and cover up to 5 family members. Compare options in our best data removal services guide.
Frequently Asked Questions
How many people were affected by the So-net data breach?
Sony Network Communications says 2,585,481 records were exposed: 2,141,986 from So-net (current members and those who left in March 2026 or later) and 443,495 from plala S Course, which serves NTT Docomo's Docomo Hikari customers.
Were passwords or credit cards stolen in the So-net breach?
Membership passwords and credit card numbers were not stolen. However, 54,401 email accounts had their mailbox passwords exposed, and 16 records included bank account details. Sony reset the affected email passwords and is contacting those customers directly.
Is the So-net breach related to PlayStation Network?
No. The breach hit Sony Network Communications, the internet provider behind So-net. Separate reports of hijacked PlayStation Network accounts circulated the same week, but Sony Interactive Entertainment had not linked them to the So-net incident.
How will I know if my So-net data was leaked?
Sony says it is notifying affected customers individually and has set up a dedicated phone line and FAQ page. If you were a So-net member at any point since March 2026, or a plala S Course or Docomo Hikari customer, assume your data was included.
What should I do first after the So-net breach?
Reset your So-net email password through My Page, change any reused passwords, turn on two-factor authentication, and ignore unexpected messages about refunds or prizes. Then reduce the rest of your exposed data: PrivacyOn alerts you when your details appear in new leaks and removes them from 100+ data broker sites from $8.33/month.