Sony ISP subsidiary So-net suffers data breach exposing 2.5 million customers

What happened

Sony Network Communications, a subsidiary of Sony, disclosed a data breach affecting approximately 2.5 million customers of its internet service provider (ISP) service, So-net. The breach exposed personal details such as phone numbers, email addresses, and in some cases, email passwords and banking information. The incident occurred on October 19, 2026, and was discovered four days later on October 23.

Attackers exfiltrated a total of 2,141,986 sensitive records. Of these, 1.8 million records belonged to current So-net customers and included names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs. Over 440,000 records were taken from plala (S Course), a service affecting NTT Docomo, which uses Sony’s infrastructure for its operations.

Impact on customers and partners

The breach also affected multiple Sony-run email services: 24,655 records from Email Service (G), 17,672 from A-Box, 7,005 from So-net VAIO Mail, and 5,069 from PostPet Mail Account Service were exposed. Additionally, 16 records containing bank account information were leaked, though Sony clarified that bank account PINs were not compromised as the company does not store them.

NTT Docomo, a major telecommunications partner, urged its customers to stay vigilant against suspicious communications following the breach. The incident impacts all Hikari service clients and those who canceled their subscriptions from May 2026 onward.

Sony Network Communications reported the breach to Japan’s Personal Information Protection Commission and other relevant government and law enforcement organizations. No hacking groups have claimed responsibility for the attack, and the exposed data has not appeared on the dark web.

Broader context in Japan’s tech sector

The breach at Sony Network Communications follows a recent cybersecurity incident involving GMO Group, another Japanese technology company. GMO Group had previously advised its customers to scan their computers for viruses and back up their data, signaling heightened cybersecurity risks in the region.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This breach underscores the cascading risks of infrastructure-sharing arrangements, where a single vulnerability can expose multiple brands and millions of customers. For founders and operators, especially in sectors like ISPs or cloud services, the incident is a reminder of the importance of real-time monitoring and rapid incident response. The exposure of email credentials, even for a fraction of users, creates a ripe environment for phishing attacks, which could further erode trust in Sony’s services or those of its partners like NTT Docomo.

The lack of dark web activity or claims of responsibility adds uncertainty—either the attack was highly targeted, or the investigation is still unfolding. Either way, companies in Japan’s tech ecosystem may face increased regulatory scrutiny or customer demands for transparency in the coming months.

Key takeaways

• Founders and operators in the ISP or tech infrastructure space should assess their incident response protocols, particularly the four-day lag between breach occurrence and detection.
• The exposure of email passwords and banking information, even in a limited number of cases, highlights the risk of phishing attacks targeting affected users—competitors in Japan’s ISP market may see increased customer churn or scrutiny.
• The lack of dark web activity or claims of responsibility suggests either a quiet, targeted attack or one still under investigation, which may delay broader industry learnings.

Related on Lazyfounder

• More technology news