Sony Network Communications, a subsidiary of Sony Group Corporation operating as an internet service provider in Japan, has disclosed a significant data breach. The incident compromised approximately 2.5 million records belonging to current and former customers, exposing personal information stored in the company's So-net member database that supports its internet access service.

The unauthorized access took place on October 19, with detection occurring four days later when Sony Network Communications shut down affected servers and severed external connections. The company announced the breach yesterday after completing initial investigation work.

Scope of exposed data

Investigation determined that 2,585,481 customer records were exposed in total. The compromised dataset included the following categories of personal information:

  • Full names
  • Phone numbers
  • Email addresses
  • User IDs
  • Dates of birth
  • Gender
  • Internet Connection IDs

Financial information remained secure, with no banking details, payment card data, or other account credentials exposed. However, an additional 54,401 email addresses from multiple email services were compromised along with their associated account passwords. Sony Network Communications is urging affected users to change their passwords immediately.

The exposed records break down into 2,141,986 So-net entries and 443,495 plala (S Course) records. The plala impact extends to NTT Docomo, which contracts Sony Network Communications to deliver its Docomo Hikari services.

Secondary impact on NTT Docomo

NTT Docomo has separately notified its customers about the breach and warned of ongoing phishing campaigns and fraudulent websites. These malicious sites impersonate Docomo's d POINT Club and a Universal Studios Japan (USJ) campaign, falsely claiming that recipients have won prizes and requesting personal information to claim tickets.

According to Docomo, the incident affects all current Hikari service subscribers and those who canceled their service within the previous six months.

Investigation status and broader context

Sony Network Communications has reported the incident to Japan's Personal Information Protection Commission and continues investigating the cause and scope of the breach. As of October 27, neither company had detected any confirmed misuse of the exposed data in the wild.

This breach is part of an escalating pattern of cyberattacks targeting major Japanese companies and service providers throughout 2025. GMO Internet Group and its Onamae Desktop Cloud service experienced a widespread malware attack affecting customer servers. Telecommunications giant KDDI suffered a breach impacting 12 million customers, while IDC Frontier fell victim to ransomware. Earlier in 2025, NTT itself was compromised by attackers who accessed its systems and obtained data from 18,000 corporate customers.

The surge in data breaches has prompted urgent action at the government level. The Japanese government convened emergency meetings on Monday to develop a coordinated response strategy to the unprecedented threat landscape.