Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications, a subsidiary of Sony Group Corporation that provides telecommunications and technology services and operates as an internet service provider in Japan, has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. The breach occurred on October 19 and was detected four days later, at which point the company shut down the compromised servers and blocked external communication. In an announcement on Tuesday, the company said its So-net member database, which supports its internet access service, had been accessed by an unauthorized party. The investigation confirmed that a total of 2,585,481 customer records had been exposed. The company said no banking, payment card, or other account details were included in the exposed data. An additional 54,401 email addresses from several email services were also exposed along with account passwords. Sony Network Communications is advising affected users to change their passwords. According to the company's breakdown of exposed records, 2,141,986 entries relate to So-net customers and 443,495 records relate to plala (S Course) customers. The latter group affects another internet service provider, NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services. NTT Docomo has also notified its customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign. The fraudulent messages falsely claim that recipients have won tickets and prompt them to enter personal information to claim the prize. Docomo said the incident affects all current Hikari service clients as well as those who canceled within the preceding six months. Sony reported the incident to Japan's Personal Information Protection Commission and is continuing to investigate the cause and scope of the breach. As of October 27, neither company had confirmed any misuse of the exposed data. The incident is the latest in a series of cyberattacks targeting high-value companies and service providers in Japan this year. Among the most recent, GMO Internet Group's Onamae Desktop Cloud service suffered a widespread malware attack on customer servers, telecommunications giant KDDI disclosed a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware. Earlier in 2025, NTT was hit by hackers who gained access to its systems and stole the data of 18,000 corporate customers. The pace of breaches has prompted a government response, with Japanese officials holding urgent meetings on Monday to plan how to address what has been described as an unprecedented and threatening rate of data breaches.