Identity

So-net breach: 2.58 million records, 54,401 mail passwords

By Yaali. October 31, 2026, 6 min read, Identity, Phishing, Threat intel.

Sony Network Communications says So-net and plala member data leaked, with live passwords for 54,401 mailboxes. What the fields enable and what to check.

On October 27, Sony Network Communications, the Sony subsidiary that runs the So-net internet service in Japan, said someone had broken into its member database. The leak covers 2,585,481 member records: 2,141,986 from So-net and 443,495 from NTT Docomo's plala (S course), a Docomo Hikari plan whose member database So-net runs as a contractor. Each record holds name, phone number, email address, So-net user ID, date of birth, gender and internet connection ID. For 54,401 addresses on four So-net mail services, the mailbox password leaked too, along with bank account details for 16 members.

The member records matter to anyone who sends email or SMS to Japanese consumers, because they give a phisher everything needed to sound like So-net, Docomo or a bank. The mail passwords matter more. Sony Network Communications says that anyone holding them could read and send mail through a mail client or So-net Webmail, and a personal mailbox is where password reset links for other services arrive. If your users, customers or staff sign in with addresses on these domains, the risk reaches your systems as well as theirs.

What leaked, and from which services

The member data includes current members and anyone who left So-net in March 2026 or later; Docomo describes the plala scope as customers who cancelled within the past six months. So-net says it keeps former members' data for a while after cancellation to handle final billing and questions. Sony Network Communications says no passwords were attached to these member records, and Docomo says plala (S course) customers lost no passwords, card data or bank details.

The 54,401 mail passwords come from four So-net mail products, with these counts and domains (the asterisks stand for a customer-chosen subdomain):

The basic mailbox that comes with every So-net membership is not affected, and neither are My Page sign-in passwords, apart from 7 members whose password reset letter details leaked. The 16 bank records hold institution name and code, branch, account type, account number and holder name. So-net holds no card numbers or account PINs.

The cause has not been published. The company says the intrusion happened on October 19 and was confirmed on October 23, when it shut down the affected server and blocked the source address. It identified the leaked data on October 24, told Docomo on October 26 and went public on October 27.

What the exposed fields enable

Name, phone, email and date of birth in one record are enough for a convincing message. A text that quotes the recipient's name and So-net user ID, warns about "the recent incident" and links to a page asking them to "verify" their My Page password or bank details will work on people who have just read the news. So-net, Docomo and the reporting all warn against replying to unexpected emails, SMS or calls about the breach. The internet connection ID adds a detail that only the provider should know, which makes a fake support call harder to spot.

Date of birth is also a common security question. Any service that resets a password or unlocks an account after the caller gives name, phone number and birth date can now be beaten for these 2.58 million records.

The mail passwords open the more direct route. With the mailbox password, an attacker can sign in over a mail client or webmail and then request password resets on shopping, banking and social accounts that use that address, reading the links as they arrive. They can also send mail as the victim to the victim's contacts, which passes SPF, DKIM and DMARC checks because it really comes from So-net's servers. Anyone who used the same password elsewhere is exposed to credential stuffing too: automated logins that try the leaked email and password pair on other sites.

So-net did not reset the passwords until about 10:00 on October 27, rolled out in stages and without warning. So the stolen set may have worked for up to eight days after the intrusion. Neither company had confirmed any misuse as of October 27, but logs from those days are the ones to read.

What to do

If you run a service with Japanese customers

1. Search your user table for email addresses on the affected domains. A filter on the domain part, ending in .gyao.ne.jp, .gate01.com, .pbc.ne.jp, .highway.ne.jp or .vaio.ne.jp, or starting with abox or postpet under so-net.ne.jp, gives you the accounts whose mailboxes may have been open to the attacker.
2. For those accounts, pull password reset requests, email address changes and new device sign-ins from October 19 onwards. A reset followed within minutes by a sign-in from a new network or country, or an email change right after a reset, is the pattern to look for. Treat a match as a likely takeover: lock the account, end its sessions and contact the user by phone or in the app.
3. Turn on breached-password checks and rate limits at login if you have not, and expect more credential stuffing against so-net.ne.jp addresses in general. Most So-net members' mail passwords did not leak, but their user IDs and addresses did.
4. Stop accepting name, phone number and date of birth as proof of identity at your contact centre or in account recovery. Use a one-time code to a device already registered on the account, or a callback to the number on file.
5. If you message Japanese consumers, tell them now what you will never ask for by email or SMS, and point them to your app or a URL they type themselves.

If your staff use So-net mail

Personal mailboxes often sit in work mail clients on shared or home PCs, or receive forwarded work mail. Ask staff with addresses on the listed domains to set a new mail password through So-net's My Page and then enter the new password in Outlook or any other client, in that order, as So-net's FAQ describes. Have them check the account for forwarding rules or filters they did not create, and change the password on every other service where they reused it. If a work account lists one of these addresses as its recovery email, replace it.

The 16 bank account holders and 7 password letter recipients are being contacted individually by So-net.

The wider picture

The So-net disclosure came a day after Prime Minister Sanae Takaichi held an emergency ministerial meeting on October 26 and ordered cyber measures to be drafted within about a week. That followed the October 9 agency advisories we covered in our post on Japan's cyberspace emergency, and the same week brought JAL's notice about booking data taken through Amadeus, covered in our Amadeus post. For anyone serving Japanese users, each new leak adds to the store of names, birth dates and addresses that later phishing and account recovery attacks draw on. Account recovery that relies on those facts gets weaker with every disclosure.

Our web penetration testing covers password reset, account recovery and login rate limiting, and our security operations team can build the reset and sign-in queries above into standing alerts. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: So-net FAQ on the incident, Sony Network Communications notice (PDF), NTT Docomo notice on plala (S course), Impress Watch, Internet Watch, innovatopia, The Record, Claims Journal, Nippon.com via Jiji Press.