Sony Network Communications, which runs the So-net internet service in Japan, said on October 27 that an outside party broke into its member database and took personal information covering more than 2.58 million records, including passwords for 54,401 email addresses and details of 16 bank accounts.

According to the company’s notice, the unauthorized access took place on Monday, October 19. The company confirmed it on October 23, shut down the affected server and blocked communications from the source. By October 24, its investigation had established that personal information had leaked and identified which data and how many records were involved.

What was taken

The largest set covers 2,141,986 So-net members: 1,869,771 current members and 272,215 former members who left in March 2026 or later. A further 443,495 records belong to members of plala’s S Course service, 422,365 current and 21,130 former. For both groups the leaked fields are name, phone number, email address, user ID, date of birth, gender and internet connection ID. The company said no passwords were leaked from these records and that people who canceled by the end of February 2026 are not affected.

Passwords were exposed for 54,401 addresses on four So-net mail services: 24,655 on the free Mail Service (G), 17,672 on A-Box additional mailboxes, 7,005 on So-net VAIO Mail and 5,069 on the PostPet mail account service. These addresses belong to current and former So-net members already counted above. So-net’s FAQ on the incident says the basic mailbox included with membership is not affected.

The notice also lists 16 leaked bank account records, covering the financial institution and branch, account type, account number and account holder’s name. The company said it does not hold account PINs and that plala S Course members were not affected by this part of the leak. Seven records from notices issued for password resets were also exposed, and those passwords have been reset. No credit card information was included in any category, and the company said it has not found leaks from other services, including NURO.

Cause still under investigation

The company gives the cause only as unauthorized access by a third party and says its investigation is continuing. It has reported the incident to Japan’s Personal Information Protection Commission. CyberInsider noted that Sony has not disclosed how the email passwords were stored.

To prevent further damage, the company reset the 54,401 affected email passwords itself on October 27. Those customers must set new passwords through the So-net My Page portal and update any mail software they use; the FAQ says a new password can take up to 30 minutes to take effect.

As of October 27, the company said it had not identified any secondary harm from the leak, and the FAQ, updated on October 29, still reports none. It warned that the data could be used for suspicious contact and asked customers not to respond to unexpected emails, text messages or phone calls, and not to open links or attachments in them.

A second Japanese disclosure in a week

The announcement followed a breach notice from video game publisher Capcom on October 22. Capcom said unauthorized access to its CAPCOM ID account service, detected on October 19, exposed 11,774,247 records of email addresses and system identifiers such as account creation date, last login date, login count and the IP address used at last login. For 43 of those records, date of birth, gender, country or region and nickname were also exposed, and passwords were changed without authorization on 196 accounts, which Capcom has reset.

In an update on October 23, Capcom said an unauthorized party had accessed the e-Capcom online store pages of 19 of those 196 accounts, exposing details including names, addresses, phone numbers and purchase histories. Capcom said credit card information was not affected. Neither company’s notice refers to the other incident.

Why it matters

Both companies warned that the leaked details could be used in messages impersonating them or related parties, and both asked customers to avoid links and attachments in unexpected messages. The So-net data pairs phone numbers and email addresses with names and dates of birth across more than 2.58 million records.

The So-net leak also goes beyond contact details. It includes working credentials for 54,401 mailboxes, which the company reset itself, bank account details for 16 customers and records tied to seven password-reset notices. The company said it will contact affected customers individually.

What to watch

Sony Network Communications says it is still investigating the cause and full scope, and that it will review its security measures and information management. Capcom said its investigation into the scope of impact is complete and that it will continue monitoring CAPCOM ID and related services.

The caveats

The figures come from the companies’ own notices and reflect what they had confirmed at the time of publication. Neither company has explained how the intruders got in. Sony Network Communications’ figures reflect what it had confirmed by October 27, and its investigation is continuing.

Corrections and tips: email the editor using the address on the Contact page.