Sony Network Communications Breach Exposes 2.58 Million Customer Records

Sony Network Communications disclosed that unauthorized access to its So-net member database exposed 2,585,481 records belonging to current and former So-net and plala (S Course) customers. The breach included personal and membership information, credentials for 54,401 email accounts, 16 bank account records, and information from seven password-reset notices. Main membership account passwords and credit card information were not exposed. The intrusion occurred on October 19, 2026, and was detected on October 23; Sony disclosed the incident on October 27.

Sony stopped the affected servers, blocked communications from the attack source, reset exposed email passwords on October 27, and reported the incident to Japan’s Personal Information Protection Commission. The intrusion method, any exploited vulnerability, and the attacker’s identity remained undisclosed. Sony had confirmed no resulting secondary harm as of October 27, but warned customers about scam communications; the exposed personal information and email credentials create risks of targeted phishing and mailbox compromise. No connection was established with the separate Sony Interactive Entertainment MOVEit breach, while separate reports of PlayStation Network account hijackings remained unconfirmed as to cause.