Sony Network Communications, the operator of the So-net internet service, has disclosed that an intrusion exposed 2,585,481 customer records, including customers of NTT Docomo’s Hikari fiber service. The company also says 54,401 email addresses from its email services were exposed along with their account passwords.
Breakdown of the 2,585,481 Exposed So-net and plala Records
The records divide into two groups. A total of 2,141,986 are So-net entries and 443,495 are plala entries under the S Course plan. The plala group covers Docomo Hikari customers, both current ones and those who cancelled within the previous six months.
Separately, 54,401 email addresses from email services were exposed together with account passwords. The company says no bank, payment card or other account details were exposed, and it has told users to change their passwords.
Four Days Between Intrusion and Detection
The intrusion took place on October 19. Sony Network Communications detected it four days later, shut down the affected servers and blocked external communication. It announced the breach on October 27. The company has reported the incident to Japan’s Personal Information Protection Commission, and says it has confirmed no misuse as of its announcement. The cause remains under investigation.
Docomo’s Warning About Phishing and Fake Sites
NTT Docomo, whose Hikari customers are among those affected, has warned of phishing emails and fake websites that impersonate d POINT Club. It also flagged a fraudulent campaign using the name of a Universal Studios Japan promotion. The warnings reflect an expectation that criminals will use details from the breach, or the publicity around it, to approach victims.
Why the Passwords Alongside 54,401 Email Addresses Matter
The disclosure that passwords were exposed with the email addresses is the most direct risk to individuals. Credentials tied to an email account can unlock further services if people reuse them, which is the reason the company’s instruction to change passwords carries weight. The announcement does not say whether the passwords were stored in hashed form.
A Breach in a Broader Run of Japanese Incidents
The Sony subsidiary’s case forms part of a series of breaches affecting Japanese companies, a trend that has already prompted Prime Minister Sanae Takaichi to promise emergency measures. Another part of that wave, the Amadeus breach that exposed 92,000 Japan Airlines customers, is covered in companion reporting. The incidents have not been publicly connected to a single attacker or method.
What the Sony Network Communications Timeline Suggests
The timeline in this case contains several useful details. Detection came four days after the intrusion, and public disclosure came eight days after it. For a provider with more than two million subscriber records, that sequence shows the company acted to contain the incident before it announced, but it leaves open how much data was accessible during the four days that elapsed before servers were shut down.
The involvement of a second brand adds a notification issue. Docomo Hikari customers appear in the plala portion because the Sony subsidiary runs that service, so people who think of themselves as Docomo customers may not recognize the name of the company that lost their data. Docomo’s own phishing warning helps to bridge that gap.
Because the cause is still under investigation, the answers that will matter most are the entry point and whether the stolen data has appeared for sale. Neither is known yet, and the regulator’s review will likely shape what the company must disclose next.
The split between 2,141,986 So-net records and 443,495 plala records also shows the breach’s reach across brands. The So-net count is nearly five times the plala count, so most affected customers are direct subscribers of the Sony subsidiary, while the plala group includes people who have already left the service within the last six months. That detail means a customer who cancelled recently may still be among those whose records were exposed.
