For: members of So-net or plala (S-Course), including people who left in or after March 2026. In particular, anyone who uses (or used) Mail Service G, A-Box, Sonnet VAIO Mail or PostPet Mail Account Service. This article is based on Sony Network Communications' official notice and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 29, 2026Not yet known
- Cause and route of the intrusion
- Number of people affected (how the counts relate and overlap)
- How and to whom individual notices are sent
- Whether any secondary harm occurs
- Whether there is compensation
In the notice and its FAQ, the company says it will report any new information in its news releases. It gives no schedule. We checked the FAQ on October 29 and found no announcement newer than the October 27 notice.
What members and former members should do today
Work out whether you could be in scope
The leak was confirmed for So-net member information (2,141,986 records) and plala (S-Course) member information (443,495 records). Both include current members and former members who left in or after March 2026. The company says nothing leaked for people who left by the end of February 2026.
The company's FAQ says it is still identifying who is affected. If you were a member during that period, assume you may be in scope and go on to the next steps.
If you used one of the four mail services: reset the password
For the four services below, leaks of the email address and mail password were confirmed, and the company reset them on October 27.
- Mail Service G (free; @xxx.gyao.ne.jp, @xxx.gate01.com, @xxx.pbc.ne.jp, @xxx.highway.ne.jp)
- A-Box (additional mailbox) (paid)
- Sonnet VAIO Mail (paid)
- PostPet Mail Account Service (paid)
The notice asks you to reset the password from My Page (so-net.ne.jp/mypage). The procedure page for each service is in the company's FAQ (so-net.ne.jp/support/faq, in Japanese). If you use mail software such as Outlook, also change the "password" in its settings after resetting. It can take from a few minutes to about 30 minutes to take effect. You can check which services you contract in My Page.
Change passwords you reused, and review your mail settings
The company's FAQ explains that, because the address and password leaked, a third party who obtained them could read and send mail, which is why it forced the change as an emergency measure.
So if you used that mail password on any other service, change it there too (how to check if your password was leaked / choosing a password manager). Turn on two-step verification where available. If you signed up for many services with this address, also check for login alerts or password-reset emails you do not recognise (this site's recommendation).
Do not use links or phone numbers in emails, texts or calls claiming to be So-net
As of October 27 the company had not confirmed any secondary harm, but it warns that suspicious contacts that misuse the leaked information may arrive. It asks people not to respond to emails, texts or calls, not to open links and not to open attachments.
This time names, phone numbers and birth dates are combined, so a fake message can look genuine. If you are told to "confirm your member details", "reset your password" or that you are due an "apology refund", do not use the links or phone numbers in the message. Check on the official site you open yourself, or call the special phone line (0120-36-8887).
plala (S-Course) members: check if you use Docomo Hikari
plala (S-Course) is listed as one of the internet providers for Docomo Hikari on NTT Docomo's official page (new applications ended on February 29, 2024; existing customers can keep using it). If you chose this provider with Docomo Hikari, you could be in scope of the plala (S-Course) member information. The company says no bank account information leaked for plala (S-Course) members. For this incident, the contact is the company's special phone line.
If your bank account or notice information is involved: confirm the contact by phone yourself
Bank account information (financial institution, branch, account type, account number, account holder and more) for 16 records and password-reset notice information for 7 records leaked, and the company says it will contact the people concerned individually. It says it does not hold account PINs. For notice information it also reset the passwords.
If you are contacted, first confirm it is genuine by calling the special phone line yourself. For bank account numbers, do not respond to anyone asking for your PIN or password, and contact your bank or the police if anything looks wrong (general advice from the Japanese Bankers Association and the National Police Agency, not advice about this incident).
1. Email / text / call claiming to be So-net
Name, phone number and birth date are correct → do not decide here
↓
2. Do not use its links or numbers: open the official site yourself, or call the special phone line yourself
So-net special phone line 0120-36-8887
↓
3a. A request you cannot confirm
Entering a password, PIN or card number, or opening an attachment → do not respond
3b. The official site gives the same guidance
Follow the official site's instructions
What happened (according to Sony Network Communications)
The following is based on the notice "Apology and notice regarding the information leak caused by unauthorized access to the So-net member database", published on October 27, 2026, and on the company's FAQ. The counts are given per category, so this site has not added them together.
Oct 19, 2026 (Mon)
The So-net member database was accessed from outside without authorization.Oct 23 (Fri)
The company confirmed the unauthorized access. After confirming it, it promptly stopped the affected server and blocked communications from the source.Oct 24 (Sat)
The investigation found that personal information had leaked, and the company established the items and counts.Oct 27 (Tue)
Announced. Mail passwords were reset (from around 10:00 in stages, per the FAQ). The company set up a special phone line. The notice says it has also reported to the Personal Information Protection Commission (no date given for the report).
- So-net member information
- 2,141,986 records (1,869,771 current members, 272,215 former members). Name, phone number, email address, user ID, date of birth, gender, internet connection ID. No password leaked
- Email addresses and passwords
- Mail Service G 24,655; A-Box 17,672; Sonnet VAIO Mail 7,005; PostPet Mail Account Service 5,069 (all counts of addresses). Reset on October 27
- plala (S-Course) member information
- 443,495 records (422,365 current members, 21,130 former members). Same items as the So-net member information. No password leaked
- Bank account information
- 16 records (financial institution, bank number, branch name, branch number, account type, account number, account holder). The company does not hold account PINs. Nothing leaked for plala (S-Course) members
- Member notice information
- 7 records (information on notices issued for password resets). Passwords were reset, and the company says it will contact the people concerned individually
- Not included
- Credit card information (not in any of the above). The company has not confirmed a leak from other services, including NURO
- Contact
- So-net special phone line 0120-36-8887 (10:00 to 18:00 Japan time, weekdays and Saturdays; also open Sunday November 1 and holiday November 3)
Former members are people who left in or after March 2026. The company's FAQ explains that it keeps information for a certain period after cancellation to bill the last month and respond to enquiries.
What is known and what is not
Status as of October 29, 2026. We will update this table as the company publishes more.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access occurred | Accessed from outside on Oct 19, confirmed Oct 23 | Confirmed (company) |
| Name, phone, email, user ID, date of birth, gender, internet connection ID (So-net members) | 2,141,986 records | Leak confirmed (company) |
| Same items (plala S-Course members) | 443,495 records | Leak confirmed (company) |
| Email addresses and passwords | 54,401 addresses on four services in total; reset on Oct 27 | Leak confirmed (company) |
| Bank account information | 16 records; account PINs not held | Leak confirmed (company) |
| Member notice information | 7 records | Leak confirmed (company) |
| Passwords (member information) | No leak. My Page password and Basic Mailbox password not confirmed (FAQ) | Not included (company) |
| Credit card information | Not included (not held, per FAQ) | Not included (company) |
| NURO and other services | No information leak confirmed | Not confirmed (company) |
| Link to the four mail services | The mail leak is described as among current and former So-net members; overlap with the member information is not stated | Not stated |
| Number of people | Given in records; overlap between categories not stated | Not stated |
| Cause and route of the intrusion | "Unauthorized access by a third party (under investigation)" | Under investigation |
| Individual contact | The notice says affected customers will be contacted individually; the FAQ says individually for bank account and notice information. Method not stated | Not stated |
| Secondary harm | Not confirmed as of Oct 27; warns of suspicious contacts | Not confirmed (company) |
| Compensation | Not stated | Not stated |
Note: these are record counts, not people, and the notice and FAQ word it slightly differently
All figures are in records (addresses for mail), not people. If the same person has both a So-net and a plala (S-Course) membership, or several mailboxes, the number of people may be smaller, but the overlap is not stated. The company's FAQ says "up to 2.586 million records of personal information may have leaked" and "it is highly likely", while the notice says the leak "was confirmed" and "the leaked information is as follows". This site follows the notice and says "leak confirmed (company)", and treats the FAQ's total as a maximum.
What the combination of leaked items could be used for
The following is what can generally happen with this combination of items. The company has not announced that any of it has happened in this incident.
- Name + phone number + date of birth + user ID: texts or calls claiming to be So-net that pretend to be an identity check. A birth date is a handy way to look like someone who "only you would know"
- Email address + mail password: mail could be read or sent, and a password-reset message for another service could be received (the FAQ gives this as a reason for the forced change)
- Internet connection ID: not the connection password itself, but material for posing as a subscriber (the company says a leak of connection passwords for some services has not been confirmed)
- Bank account information: could be used for messages posing as a bank (16 records, whom the company will contact individually)
Most of this can be prevented by not using the links or numbers in a message and checking on an official site you open yourself or through the special phone line. Check the company's news releases for updates.
What operators should review
The cause has not been disclosed, so this section covers only what can be said from the published information.
- What you keep about former customers, and for how long: the company says it keeps information for a period after cancellation. Members who left in or after March 2026 are within scope. Set the purpose and period for keeping data, and delete information once the period has passed.
- How mail passwords were stored: mail passwords leaked on four services. The notice does not say how they were stored, so that is unknown. In general, passwords should be stored in a form that cannot be turned back into the original text, so that a leak does not reach users.
- Speed of the first response: the company stopped the server after confirming the access and reset the mail passwords on the day of the announcement. That is what the published timeline shows about stopping a third party's ability to read mail early.
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause, the number of people or the route of the intrusion, which have not been announced.
- Sony Network Communications Inc., "Apology and notice regarding the information leak caused by unauthorized access to the So-net member database" (Japanese, October 27, 2026) — sonynetwork.co.jp (PDF)
- So-net, "Questions and answers about unauthorized access to the So-net member database" (Japanese, checked October 29, 2026) — so-net.ne.jp
- NTT Docomo, "Docomo Hikari plala (S-Course)" (Japanese, guide to internet providers for Docomo Hikari) — docomo.ne.jp
- Japanese Bankers Association (general advice) — zenginkyo.or.jp / National Police Agency (general advice) — npa.go.jp
Update history
2026-10-29: First version, based on Sony Network Communications' notice of October 27 and its FAQ (checked October 29; nothing newer than the October 27 notice found). We will update when the cause, the number of people or compensation are announced.
Read next
- A similar case (an internet provider's member data): NIFTY unauthorized access
- A Japanese retail case from the same period: MrMax (members' names, emails and phone numbers)
- Follow-on scams: What is phishing? / Smartphone security basics
- Protect your accounts: How to check if your password was leaked / Choosing a password manager / Choosing multi-factor authentication
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)