So-net Data Breach: What Leaked for Each Customer Group

Sony Network Communications says someone outside the company got into the member database of its So-net internet service on 19 October 2026. Its notice of 27 October lists 2,585,481 leaked customer records: 2,141,986 from So-net and 443,495 from plala (S Course). Member login passwords were not taken, the company says. Passwords for 54,401 addresses on four mail services were.

Below, the leak is sorted by customer group and data type, with what each item lets a criminal do. Then come steps for customers and lessons for any company that keeps records on people who have left. For the basics of the term, see our data breach glossary entry.

Leaked Data by Group: So-net vs plala Members

The table follows the So-net notice, which was last updated on 29 October. “Leaked” means So-net confirmed the item was taken. “Not leaked” means So-net found no leak of it, or never held it.

How to Read the Table

A few rows need a short note. Each one changes who should act.

• Former customers are in the data. The So-net count includes 272,215 people who left from March 2026 onward. The plala count includes 21,130 former members. People who left by the end of February 2026 are not affected, So-net says.
• Four mail services lost passwords. Mail Service (G) had 24,655 affected addresses and A-Box had 17,672. Sonet VAIO Mail had 7,005, and the PostPet mail account service had 5,069.
• The basic mailbox is not on the list. So-net found no password leak for the free basic mailbox that comes with every So-net contract.
• Bank details leaked without PINs. For 16 customers, the leak covered bank name and code, branch name and number, account type, account number and holder name. So-net says it does not hold account PINs.
• Seven reset notices leaked. These are notices issued so a member can reset a password. So-net reset the passwords of those customers.

So-net also says it found no leak in its other services, including NURO.

Why the 54,401 Mailbox Passwords Matter Most

Names and phone numbers help a scammer sound real. A working mailbox password goes further. So-net’s own FAQ says anyone holding these passwords could read, send and receive mail through mail apps and So-net Webmail.

That is why So-net reset those mailbox passwords on 27 October, from about 10:00, without warning customers first. Affected customers must set a new password before the mailbox works again. They must also enter it in any mail app, such as Outlook.

A mailbox is also where reset links for other accounts arrive. If the same password was used elsewhere, those accounts are exposed too. Our page on how to respond to leaked credentials covers the order of resets and checks.

Mail accounts at Japanese providers already have a market. In Brandefense Blackhole, our cybercrime database, we found at least nine Telegram ads posted between 1 and 16 October 2026, before this breach. In them, English-language sellers of spam tools listed SMTP access at Japanese providers among many mail services offered for bulk sending. These are unverified seller claims, and nothing ties them to this breach.

What Criminals Can Do With the Other Records

Most of the 2.6 million records hold contact and identity details, not passwords. That mix suits fraud that poses as the provider. A message that quotes a real name, birth date and user ID looks far more genuine.

So-net said that, as of 29 October, it had found no secondary harm from the breach. It still warns that suspicious contact using the leaked data may follow. Its warning covers texts and calls as well as email:

• Do not reply to suspicious emails, text messages or phone calls.
• Do not open links in the message.
• Do not open attached files.

Our Phishing 101 guide explains how these messages work and how to check one before you act.

Steps for So-net and plala Customers

1. Check your contract on So-net’s My Page to see if you use one of the four mail services. If you do, set a new mailbox password, then update it in your mail app.
2. If you used that mailbox password on any other account, change it there too.
3. Treat any message about the breach as suspect, even if it uses your real name and user ID.
4. Do not use links or numbers from a message. CISA advises finding the company’s contact details on its verified website instead.
5. Look in My Page and your email for a notice if you might be one of the 16 bank account or 7 reset notice cases. So-net says it contacted them one by one and mailed letters on 29 October.

So-net runs a special phone line for this case, 0120-36-8887, on weekdays and Saturdays from 10:00 to 18:00.

Lessons for Companies That Hold Customer Data

Internet providers hold the details that fraud needs: names, phone numbers, birth dates, and often mailboxes and bank data. Our page on the SK Telecom USIM data breach shows another subscriber database that attackers reached. Three points from the So-net case apply well beyond Japan.

• Old records widen the damage. So-net keeps data on former members for a period, for the final bill and for questions. The leak includes 293,345 former members. Check how long you keep such data, and why.
• Plan forced resets before you need them. So-net reset 54,401 mailbox passwords four days after it found the access. Know how you would do the same at scale, and how you would tell customers.
• Watch for your data outside your walls. Leaked records and passwords can turn up on criminal markets after a breach. Our leaked credential monitoring use case explains how to watch for exposed logins.

For the first days after a breach, our Data Breach Response 101 guide sets out the order of work. Japan’s Personal Information Protection Commission (PPC) requires a report when a leak may involve wrongful intent or more than 1,000 people. So-net says it reported this case to the PPC.

What So-net Has Not Said Yet

So-net gives the cause only as unauthorized access by a third party, still under investigation. It has not said how the attacker got in or who it was. It says no new leak has been found since it stopped the server.

The timeline so far is short. The access took place on 19 October. So-net found it on 23 October, stopped the server and blocked the source. On 24 October it confirmed which items leaked and how many, and it published its notice on 27 October.