Sony Data Breach Exposes 2.58 Million Records and 54,000 Passwords

Sony Network Communications has confirmed a data breach affecting 2,585,481 customer records belonging to current and former users of its internet services in Japan. Attackers accessed a database containing names, email addresses, phone numbers, and other personal information.

According to Sony’s official announcement, the breach occurred on October 19, 2026, but the company did not detect the intrusion until October 23.

The incident also exposed 54,401 email addresses and associated account passwords, prompting Sony to recommend password changes for affected users.

Sony data breach affects So-net and plala customers

The attackers gained unauthorized access to Sony’s So-net member database, exposing personal information belonging to customers of two internet services.

The compromised records include full names, phone numbers, email addresses, user IDs, dates of birth, gender information, and internet connection IDs.

Of the 2,585,481 exposed records, 2,141,986 belong to So-net customers, while another 443,495 involve users of the plala (S Course) service.

The plala exposure also affects NTT Docomo customers, including current Hikari subscribers and former customers who canceled their services within the previous six months.

Sony confirmed that the compromised database did not contain banking information or payment card details.

Sony shuts down affected servers and warns customers

After discovering the breach on October 23, Sony shut down the compromised servers and blocked external communications to prevent further unauthorized access.

The company also reported the incident to Japan’s Personal Information Protection Commission and launched an investigation into the intrusion.

Sony recommends that customers whose email account credentials were exposed change their passwords to prevent unauthorized account access.

NTT Docomo has also warned customers about phishing emails and fraudulent websites impersonating its d POINT Club and Universal Studios Japan promotions.

The exposed names, email addresses, and phone numbers could help attackers create convincing phishing messages targeting affected customers.

As of October 27, neither Sony nor NTT Docomo had confirmed any misuse of the stolen customer information.

Meanwhile, Microsoft has also faced security challenges, including an AuthMask vulnerability in Microsoft Authenticator that allowed malicious Android apps to steal corporate tokens before the company patched it.

Microsoft has also removed custom CSS layout options from Entra ID to combat phishing attacks and plans to introduce AI-powered phishing and impersonation detection in Teams.

Via BleepingComputer