Incident BriefingsSo-net member-database incident

So-net member-database incident

The notice separates member records, mail-service credentials and smaller groups with additional affected information.

Last modified

Summary

  • Environment: So-net and plala S-course member database
  • Operational impact: Affected server stopped; mail-password resets required
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed October 31, 2026; updated as evidence emerges.

What happened

Sony Network Communications reported unauthorized access to its So-net member database on October 19, 2026. It detected the access on October 23 and confirmed leakage and scope the next day. [2]

Impact

The notice lists 2,141,986 So-net records and 443,495 plala S-course records, including current and certain former members. These are service-specific records, not a deduplicated person count. Fields included names, phone numbers, emails, user IDs, birth dates, gender and internet-connection IDs.

Separate mail-address/password counts were 24,655 for Mail Service G, 17,672 for A-Box, 7,005 for VAIO Mail and 5,069 for PostPet. These are not additional member populations. The notice identifies 16 bank-account records and seven password-reset notification records; credit-card information was excluded. [2]

Timeline

  1. Database accessed without authorization

    The incident date is distinct from later detection and disclosure.

    [2]

  2. Access detected and server stopped

    The company blocked attacker communications.

    [2]

  3. Leakage and scope confirmed

    Investigation established the affected information.

    [2]

  4. Notice published; mail-password resets required

    The Japanese notice provides exact service-specific counts.

    [2]

  5. Additional affected fields disclosed

    The notice was revised with exceptional affected fields.

    [2]

  6. Briefing updated

    This briefing was last reviewed and updated on October 31, 2026.

Threat Group & Attack Vector

The initial access method and actor remain unresolved. The company had not confirmed leakage of basic-mail passwords or information from other NURO services. [2]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

The company reported to Japan’s Personal Information Protection Commission and reset affected credentials. Its FAQ says letters went to the 16 bank-account and seven password-notification cases on October 29, with no confirmed secondary harm as of that date. [1] [2]