Breach · · 3 min read
So-net and plala breach: 2.58 million member records and some mail passwords
Sony Network Communications says an attacker reached the So-net member database on October 19, exposing names, birth dates and IDs, plus 54,401 mailbox passwords.
Sony Network Communications, the Sony Group company behind the Japanese internet provider So-net, says an attacker got into its So-net member database and took information about 2,585,481 current and former members. The leak also covers customers of NTT Docomo’s “plala (S course)” service, which So-net runs for Docomo. If you have, or recently had, one of these accounts, here’s what is known.
What happened
In its notice (in Japanese), the company says the unauthorized access happened on October 19, 2026. It noticed the access on October 23, shut down the affected server and cut off the attacker the same day. On October 24 it confirmed that personal information had leaked. It has reported the incident to Japan’s Personal Information Protection Commission and says the cause is still under investigation.
The company lists what leaked:
- So-net members: 2,141,986 records, including 272,215 former members who left in or after March 2026. Names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs.
- plala (S course) members: 443,495 records with the same kinds of data. Docomo’s own notice (in Japanese) says this covers current customers and those who cancelled in the past six months.
- Mailbox passwords: 54,401 email addresses together with their passwords, for four add-on mail services: Mail Service (G), A-Box, So-net VAIO Mail and the PostPet mail account service.
- Bank account details: 16 records with bank, branch, account number and account holder name. So-net says it doesn’t hold account PINs.
- Password reset letters: 7 records, whose passwords have been reset.
So-net says member account passwords and credit card details were not part of the leak, and that it hasn’t found leaks in its other services, including NURO. As of October 27 it said it had seen no misuse.
What this means for you
Most members lost contact details, birth dates and account IDs. That isn’t enough to sign in, but it is enough for convincing phishing: a message that knows your name, your So-net user ID and your birthday can look like it really comes from your provider. If you used one of the four mail services, your mailbox password was exposed, and So-net has already reset it.
What you can do
- If you use one of the four mail services, set a new password from So-net’s My Page. Go there by typing the address, not from a link in a message.
- Change that password anywhere else you reused it. A password manager makes every password unique.
- Don’t reply to unexpected emails, texts or calls about your account, and don’t open their links or attachments. So-net and Docomo both give this advice.
- Call the official lines if you’re unsure. So-net’s line is 0120-36-8887 (weekdays and Saturdays, 10:00 to 18:00). Docomo’s plala (S course) line is 0120-035-700 (10:00 to 19:00, every day).
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each service its own address, so a leak at one provider doesn’t lead scammers straight to your main inbox. We never collect or store the leaked records themselves.
Sources
- Sony Network Communications, So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ (in Japanese), October 27, 2026
- NTT Docomo, ドコモ光「plala（Sコース）」をご利用のお客さま情報流出に関するお知らせ (in Japanese), October 27, 2026
- ITmedia NEWS, So-net、会員情報約259万件が漏えい (in Japanese), October 27, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.