Sony So-net and plala Data Breach: 2.58 Million Records

Sony's internet provider subsidiary in Japan disclosed a breach affecting more than 2.58 million So-net and plala customers in October 2026. Here is what leaked and what to do.

1. Timeline

Unauthorized access on October 19, 2026, confirmed on October 23. Sony shut the affected server and reported it to Japan's Personal Information Protection Commission.

2. What leaked

For more than 2.58 million current and former customers: names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.

3. Passwords

Email passwords for 54,401 users of additional email services were exposed. Sony says membership account passwords were not.

4. What's not affected

Sony says NURO fiber and its other services show no leak. As of October 27 it found no misuse of the data.

5. What to do

If you used a So-net or plala email, change its password and any other account that used the same one. Turn on two-factor login and watch for phishing that uses your real name and phone number.

Sources

BleepingComputer, Help Net Security and Privacy Guides, October 2026.

FAQ

I don't live in Japan. Am I affected?

Only So-net and plala customers are affected, and those services are in Japan.

Were bank details leaked?

Reports conflict. Check Sony's own notice for the final details.