--- title: "So-net member-database incident" description: "Sony Network Communications disclosed leakage from a So-net member database, with separate mail-credential and financial-information exceptions." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-31" canonical_url: "https://www.ally.security/incidents/so-net-member-database-incident-2026" markdown_url: "https://www.ally.security/incidents/so-net-member-database-incident-2026.md" stix_url: "https://www.ally.security/incidents/so-net-member-database-incident-2026/stix.json" --- # So-net member-database incident The notice separates member records, mail-service credentials and smaller groups with additional affected information. Last modified Oct 31, 2026 · 2 sources ## Summary - **Environment:** So-net and plala S-course member database - **Operational impact:** Affected server stopped; mail-password resets required - **Financial impact:** No confirmed incident cost quantified ## What happened [Sony Network Communications](https://www.sonynetwork.co.jp/) reported unauthorized access to its So-net member database on October 19, 2026. It detected the access on October 23 and confirmed leakage and scope the next day. [2](#source-2) ## Impact The notice lists 2,141,986 So-net records and 443,495 plala S-course records, including current and certain former members. These are service-specific records, not a deduplicated person count. Fields included names, phone numbers, emails, user IDs, birth dates, gender and internet-connection IDs. Separate mail-address/password counts were 24,655 for Mail Service G, 17,672 for A-Box, 7,005 for VAIO Mail and 5,069 for PostPet. These are not additional member populations. The notice identifies 16 bank-account records and seven password-reset notification records; credit-card information was excluded. [2](#source-2) ## Timeline ### October 19, 2026 — Database accessed without authorization The incident date is distinct from later detection and disclosure. [2](#source-2) ### October 23, 2026 — Access detected and server stopped The company blocked attacker communications. [2](#source-2) ### October 24, 2026 — Leakage and scope confirmed Investigation established the affected information. [2](#source-2) ### October 27, 2026 — Notice published; mail-password resets required The [Japanese notice](https://www.so-net.ne.jp/info/2026/20261027_0001.html) provides exact service-specific counts. [2](#source-2) ### October 29, 2026 — Additional affected fields disclosed The notice was revised with exceptional affected fields. [2](#source-2) ### October 31, 2026 — Briefing updated This briefing was last reviewed and updated on October 31, 2026. ## Threat Group & Attack Vector The initial access method and actor remain unresolved. The company had not confirmed leakage of basic-mail passwords or information from other NURO services. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The company reported to Japan’s Personal Information Protection Commission and reset affected credentials. Its [FAQ](https://www.so-net.ne.jp/support/faq/qa202610_01/) says letters went to the 16 bank-account and seven password-notification cases on October 29, with no confirmed secondary harm as of that date. [1](#source-1) [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Questions about unauthorized access to So-net member information official · Sony Network Communications ### Unauthorized access to a So-net member database and information leakage official · Sony Network Communications · Oct 27, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** So-net member-database breach: Information leakage and scope confirmed 2. **Resulted In · 100% confidence · current** So-net member-database breach: The notice identified 443,495 plala S-course records: 422,365 current members and 21,130 former members. These service-specific record counts are not a deduplicated population. 3. **Occurred At · 100% confidence · current** Notice revised with exceptional affected fields: 2026-10-29 4. **Resulted In · 100% confidence · current** So-net member-database breach: Sony Network Communications reported unauthorized access to a member database on October 19, detected on October 23, with information leakage and its scope confirmed on October 24. 5. **Occurred At · 100% confidence · current** Public notice and mail-password resets: 2026-10-27 6. **Resulted In · 100% confidence · current** So-net member-database breach: Affected member fields included names, phone numbers, email addresses, user IDs, birth dates, gender and internet-connection IDs. 7. **Occurred At · 100% confidence · current** Access detected; server stopped: 2026-10-23 8. **Resulted In · 100% confidence · current** So-net member-database breach: Unauthorized database access 9. **Resulted In · 100% confidence · current** So-net member-database breach: Access detected; server stopped 10. **Disclosed At · 100% confidence · current** So-net member-database breach: 2026-10-27 11. **Occurred At · 100% confidence · current** Information leakage and scope confirmed: 2026-10-24 12. **Resulted In · 100% confidence · current** So-net member-database breach: The notice listed leaked email addresses and passwords for Mail Service G (24,655), A-Box (17,672), VAIO Mail (7,005) and PostPet mail (5,069). These are separate mail-service credentials, not additional member-database populations. 13. **Resulted In · 100% confidence · current** So-net member-database breach: The company had not confirmed leakage of basic-mail passwords or information from other NURO services; the cause remained under investigation. 14. **Resulted In · 100% confidence · current** So-net member-database breach: The FAQ says letters were sent on October 29 to the 16 bank-account and seven password-reset-notification cases. It reported no confirmed secondary harm as of that date. 15. **Resulted In · 100% confidence · current** So-net member-database breach: The notice identified bank-account information in 16 records and password-reset notification information in seven records. It said bank PINs were not held, credit-card information was not included, and passwords for the seven cases had been reset. 16. **Discovered At · 100% confidence · current** So-net member-database breach: 2026-10-23 17. **Began At · 100% confidence · current** So-net member-database breach: 2026-10-19 18. **Resulted In · 100% confidence · current** So-net member-database breach: Notice revised with exceptional affected fields 19. **Affected Organization · 100% confidence · current** So-net member-database breach: Sony Network Communications 20. **Occurred At · 100% confidence · current** Unauthorized database access: 2026-10-19 21. **Resulted In · 100% confidence · current** So-net member-database breach: Public notice and mail-password resets 22. **Resulted In · 100% confidence · current** So-net member-database breach: The notice identified 2,141,986 So-net records: 1,869,771 current members and 272,215 former members who left in or after March 2026. 23. **Resulted In · 100% confidence · current** So-net member-database breach: Sony Network Communications stopped the affected server, blocked attacker communications, reported the incident to the Personal Information Protection Commission and forced affected mail-service password resets on October 27.