Sony Exposes Thousands of Email Passwords in Breach Affecting 2.58M Records

Sony Network Communications has disclosed a data breach involving 2,585,481 membership records linked to its Japanese internet services So-net and plala, following unauthorised access to a database on 19 October 2026.

The exposed information includes names, telephone numbers, email addresses and other personal details, while 54,401 email address and password combinations were also compromised.

The company published its disclosure on 27 October, confirming that both current and certain former customers were affected.

The incident also involved 16 bank account records and seven password-reset notification records, although these represent separate categories of exposed information rather than additional confirmed individuals.

Sony Breach Hits Millions of So-Net and Plala Members

Sony Network Communications reported that 2,141,986 So-net membership records and 443,495 plala (S Course) records were exposed. Combined, the figures total 2,585,481 records, or approximately 2.58 million.

The So-net figure includes 1,869,771 current members and 272,215 former customers who cancelled their subscriptions from March 2026 onwards. The plala total comprises 422,365 current members and 21,130 former customers who cancelled during the same period.

The exposed membership information includes names, telephone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Sony said passwords used for the main membership accounts were not compromised.

The breach also affected plala (S Course) customers using NTT Docomo's Docomo Hikari service. NTT Docomo confirmed on 27 October that 443,495 records were exposed, but there is no evidence that PlayStation Network or Sony's wider gaming services were affected.

54,401 Email Passwords Compromised in Separate Leak

The exposure of email credentials presents a separate concern from the membership database leak. Sony confirmed that 54,401 email addresses and their associated passwords had been compromised across four email services used by So-net customers.

The affected services were Mail Service (G), with 24,655 addresses, A-Box with 17,672, So-net VAIO Mail with 7,005 and PostPet Mail Account Service with 5,069. The figures add up to 54,401 compromised email credentials.

Sony reset the affected email passwords on 27 October as an emergency measure. Customers using the affected services must establish new passwords before they can resume normal use of those email accounts.

Sony said the compromised credentials were separate from customers' main membership passwords and that other email services were not affected. While exposed email accounts could put private correspondence at risk, there is no evidence that the stolen credentials were used to access other services.

Bank Account Details Among Exposed Records

Sony identified 16 leaked bank account records containing financial information, including financial institution names, bank and branch codes, account types, account numbers and account holders' names.

Crucially, the company specified that plala (S Course) customers were not affected by this particular exposure. The bank account records therefore should not be presented as information leaked from both customer groups.

Seven additional records relating to password-reset notification documents were also exposed.

Sony said it reset the passwords associated with those records and would contact the affected customers individually.

The company confirmed that credit card information was not included in any of the disclosed categories. It also said it did not hold customers' bank account PINs, limiting the types of financial information involved without eliminating the possibility of misuse of other exposed details.

Sony Probes Breach as Customers Warned to Stay Vigilant

Sony's timeline shows that unauthorised access occurred on 19 October and was confirmed on 23 October. The company said it stopped the affected server and blocked communications from the source of the intrusion after discovering the activity.

An investigation on 24 October established the categories and quantities of information involved. Sony reported the incident to Japan's Personal Information Protection Commission and said its investigation into the cause and full impact was continuing.

Sony reported no confirmed secondary harm as of 27 October, but the exposed data could still be misused. It urged customers to watch for suspicious emails, texts and calls, warning them against clicking unfamiliar links or downloading unexpected attachments.

The cause of the breach remains under investigation, and Sony has not identified a specific vulnerability or attacker.