Sony Data Breach Exposes 2.58 Million So-net Customers

A Sony data breach has put the personal details of more than two and a half million people in Japan at risk, and the company has now confirmed it. Sony Network Communications, the Sony Group arm that runs the internet provider So-net, disclosed on October twenty-seventh that attackers got into its member database.

What Sony says was taken

According to Help Net Security, the intruders made off with information on more than two point five eight million current and former customers. The exact total in the company's notice is two million five hundred eighty-five thousand four hundred eighty-one records.

Of those, two million one hundred forty-one thousand nine hundred eighty-six belong to So-net members. Another four hundred forty-three thousand four hundred ninety-five come from plala, an internet plan that runs on So-net's connection settings and is sold through NTT Docomo.

The exposed fields include names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs, according to CyberInsider. Sony says the passwords tied to those membership records were not leaked.

The password and bank details part

Here is where it gets sharper. For fifty-four thousand four hundred one email addresses, the attackers grabbed the password too. Those accounts sit on four mail services: Mail Service (G), A-Box, So-net VAIO Mail and PostPet mail.

The largest group, twenty-four thousand six hundred fifty-five addresses, uses the free Mail Service (G). Sony reset the passwords for all affected mail accounts on October twenty-seventh and is telling users to set new ones from their So-net account page.

The company also confirmed sixteen bank account records were exposed, including account numbers, but not bank PINs. Seven password-reset notification records were also involved, which is a separate category from the main customer totals.

How the timeline played out

Reports based on the company's disclosure say the intrusion happened on October nineteenth. Sony did not spot it until October twenty-third, when it shut down the affected server and blocked the attacker's connections.

An investigation wrapped up on October twenty-fourth confirmed that data had really been taken and worked out which fields were involved. That means attackers had roughly four days of quiet access before anyone noticed.

Former customers are caught up in this too. The company says people who cancelled before the end of February twenty twenty-six are not affected, which means folks who left from March onward still had records sitting in the database.

Why this matters beyond Japan

Even without card numbers, a leak like this is a gift for scammers. A name, a phone number, a birthday and an email address are exactly what someone needs to write a convincing fake message that looks like it came from your provider.

Sony has warned customers to be careful with suspicious messages and links. It also says it has not found any harm that followed from the breach as of October twenty-seventh, and the incident has been reported to Japan's Personal Information Protection Commission.

PlayStation accounts do not appear to be part of this one. Still, security writers keep repeating the same basic advice: if you reused a mail password anywhere else, change it now, because stolen email and password pairs get tried on other sites fast.

Why the Sony data breach keeps people on edge

Big companies are supposed to guard member databases carefully, and this Sony data breach shows how one weak point can expose millions of records. The company has not said how the attackers got in, and the notice lists the cause only as unauthorized access.

That leaves customers guessing. Until Sony shares more, the safest move is to assume the leaked details are already circulating and to protect every account that shares those details. Read more global stories on our world page.

What to do if you are a customer

If you use So-net, plala or one of the four affected mail services, reset your password and turn on two-step verification wherever it is offered. Treat unexpected texts and calls about your account with suspicion, and never tap a link in a message you did not ask for.

For everyone else, the lesson is simple. Use a password manager, give every account its own login, and watch for phishing that mentions real personal details. More tech security coverage is on our tech page, and the investigation into how the attackers got in is still ongoing.