Sony Data Breach: What Was Exposed and What to Do

In short: Sony Network Communications says hackers broke into its So-net and plala member database on October 19, 2026, exposing 2,141,986 So-net records and 443,495 plala records — names, phone numbers, emails, birthdates, user IDs and internet connection IDs — plus 54,401 email passwords, according to Sony's own notice. No main account passwords or credit card numbers were exposed, according to Sony's notice, and Sony has not disclosed the attacker's identity, according to Cyber Security News.

If you have or had a So-net or plala internet account in Japan, here is what Sony has confirmed, what it hasn't, and what to do today.

What was exposed in the Sony data breach?

Sony's notice lists two separate leak categories. For So-net, the exposed fields were "氏名、電話番号、メールアドレス、ユーザーID、生年月日、性別、インターネット接続用ID" — name, phone number, email address, user ID, date of birth, gender and internet connection ID — and the company states "パスワードの漏洩はありませんでした" (no password leakage) for that category, per the official announcement. Plala (S Course) members had the same fields exposed, also with no passwords leaked.

Separately, email addresses and passwords for four mail services were compromised, totaling 54,401 accounts: Mail Service (G) at 24,655, A-Box at 17,672, So-net VAIO Mail at 7,005, and PostPet Mail at 5,069, according to Sony's breakdown. Sixteen bank account records (financial institution, branch, account number and holder name) were also leaked, though Sony says it does not hold account PINs. Seven password-reset notification documents leaked as well, and Sony's accompanying news release PDF confirms plala members had zero exposure in the bank-account leak category.

How many people were affected by the Sony breach?

Sony's total is 2,141,986 So-net records (1,869,771 current members and 272,215 former members who canceled from March 2026 onward) and 443,495 plala records (422,365 current and 21,130 former), according to Sony's notice. That adds up to roughly 2.58 million records across both services, as Cyber Security News also reported in its coverage of the disclosure.

Is credit card data at risk from this breach?

No. Sony states plainly that "上記①～⑤いずれにもクレジットカード情報は含まれておりません" — none of the leaked categories include credit card information — and that no leak was confirmed for other Sony services, including NURO, according to the company's notice.

How long was the breach going on before Sony noticed it?

Sony says the unauthorized access happened on October 19, 2026, but it wasn't confirmed internally until October 23 — a four-day gap. The company then immediately stopped the affected server and cut off the attacker's connection, according to its official statement. Investigators established the scope of the leak on October 24, and Sony publicly disclosed the incident on October 27.

Will Sony reset my passwords?

Sony already reset the 54,401 email passwords that were exposed, doing so on October 27 "被害拡大防止のため" — to prevent further damage — and it reported the incident to Japan's Personal Information Protection Commission, per Sony's notice. Main So-net and plala account passwords were not part of the leak, so Sony has not reset those. If you reused your email password anywhere else, you need to change it yourself.

Does this breach involve Danish CPR numbers?

No. This is a leak from a Japanese internet provider's member database, and nothing in Sony's disclosure lists Danish CPR numbers among the exposed fields. The general rule still applies for any breach, wherever it happens: if a leak ever exposes your Danish CPR number, you can register a credit warning ("kreditadvarsel") in the CPR register through borger.dk when there is concrete suspicion of fraud, which makes it harder for someone to take out a loan or credit in your name, according to Sikkerdigital.dk. That step is not something this Sony breach requires, since no CPR numbers are involved.

What should I do if I had a So-net or plala account?

Follow these steps now:

1. Check which email service you use. If it's Mail Service (G), A-Box, So-net VAIO Mail, or PostPet Mail, your password was already reset by Sony on October 27.
2. Set a new, unique password for that email account if you haven't already, and change it anywhere else you reused it — see our guide on what to do if your password was leaked.
3. Watch for phishing that uses your exposed name, birthdate or phone number to sound convincing. Our guide on spotting phishing after a data breach covers the common tricks.
4. Don't respond to unexpected emails, texts or phone calls referencing your So-net or plala account, don't click links in them, and don't open attachments — Sony's own advice, per its notice.
5. Always type the official account site address directly rather than clicking a link, as recommended by Cyber Security News.
6. If you're a former customer who canceled from March 2026 onward, you're included in the leak too — the same steps apply to you.

What does Sony not know yet?

Sony says that as of October 27, "二次被害は確認されておりません" — no secondary damage has been confirmed — but it warns that suspicious contact exploiting the leaked data could still occur, per its notice. The company has not disclosed how the attacker got in, what vulnerability was used, or who is responsible; its investigation into the cause and full impact is ongoing, as Cyber Security News also noted. That outlet also reported this incident is separate from the earlier Sony MOVEit breach involving Sony Interactive Entertainment, with no link established between the two.