Sony Network Communications has confirmed that unauthorised access to the member database behind its So-net internet service went undetected for four days and exposed more than 2.58 million customer records and over 54,000 mailbox passwords. The ISP is Japanese, but the failure points it exposes are ones UK broadband providers, telcos and anyone running outsourced customer platforms should recognise.
What happened
In a notice published on 27 October 2026, Sony Network Communications, the Sony Group subsidiary that runs the So-net and NURO consumer internet brands in Japan, said an outside party gained unauthorised access to the So-net member database on Monday 19 October. The company only spotted the activity on 23 October. It then took the affected server offline and cut communications from the source of the intrusion. By 24 October its investigation had confirmed that personal data had leaked and established how many records were involved.
The total comes to 2,585,481 records. Of those, 2,141,986 relate to So-net members (1,869,771 current customers and 272,215 who left from March 2026 onwards). A further 443,495 belong to customers of plala (S Course), a service that BleepingComputer reports Sony Network Communications operates on behalf of NTT Docomo for its Docomo Hikari fibre product. Each record holds a name, phone number, email address, user ID, date of birth, gender and the customer’s internet connection ID. Sony says the account passwords for these memberships were not exposed and that no payment card data was involved.
Three smaller datasets make the incident more serious than the headline figure suggests. The attacker also obtained 54,401 email addresses together with their mailbox passwords, spread across four paid and free mail services including So-net VAIO Mail and PostPet. Sixteen bank account records were also exposed, covering bank, branch, account type, number and holder name. Sony reset the affected mailbox passwords on 27 October, has notified Japan’s data protection regulator, the Personal Information Protection Commission, and says the cause is still under investigation. NURO and other services are not believed to be affected.
The technical picture
Sony has not said how the attacker got in, so any claim about the initial access route would be guesswork. What the disclosure does show is the shape of the data store. A single subscriber database held identity data for two separate retail brands, one of them serviced for a third-party carrier, alongside credentials for legacy mail products and a small amount of banking information. That is a classic consolidation pattern in telecoms, where billing, provisioning and mail platforms end up feeding one central customer record.
The mailbox passwords are the part I would focus on. Sony has not explained how they were stored, but the decision to force resets suggests the company could not rule out that they were usable. Mailbox credentials are rarely just mailbox credentials: customers reuse them, and an ISP mail account is often the recovery address for banking, retail and social media logins. Connection IDs also tie a named person to a broadband line, which helps anyone attempting a convincing support-desk call.
The follow-on risk is already visible. According to BleepingComputer, NTT Docomo has warned customers about phishing emails and lookalike sites impersonating its loyalty scheme and a theme park ticket giveaway.
Why it matters for UK organisations
No UK customers are known to be affected, but the model is directly transferable. UK broadband is full of white-label and wholesale arrangements in which one company runs the customer platform for another brand. If your organisation provides services under someone else’s name, or relies on a supplier to hold your customers’ records, this incident is a useful test case: when the database is breached, whose customers are they, who notifies, and how fast?
The UK regime is tighter than many assume. Under UK GDPR, a reportable breach must reach the ICO within 72 hours of the controller becoming aware of it. Providers of public electronic communications services also fall under the Privacy and Electronic Communications Regulations, where the Data (Use and Access) Act 2025 replaced the old 24-hour reporting rule with the same 72-hour window. A four-day gap between intrusion and detection, as Sony experienced, would not breach that deadline on its own, because the clock starts at awareness. It would, however, raise questions about logging and monitoring that the ICO routinely asks after an incident.
There is also a data minimisation angle. Sony’s notice makes clear that customers who left before March 2026 were not affected, which suggests the database still held records for people who had left several months earlier. Holding leavers’ identity data, connection IDs and old mailbox credentials for longer than needed widens the blast radius for no business gain.
Expert view
In my experience, the subscriber database is one of the most connected systems in any telco or ISP. It talks to billing, CRM, provisioning, mail, customer portals and frequently to partners. When we test these environments, the weakest links are rarely the production database itself: they are the reporting replicas, the integration accounts with broad read access and the legacy services nobody wants to switch off. Legacy mail products in general tend to sit on ageing platforms whose password storage can predate modern hashing practice; Sony has not said how its own were stored.
The dwell time is the other lesson. Four days is ample time for a database export. If you cannot answer the question “would we notice a bulk read of the customer table within an hour?”, you have a detection gap rather than a prevention problem.
Finally, the partner dimension deserves more attention than it gets. Docomo’s customers were exposed through a platform Docomo did not run. UK organisations with similar arrangements should make sure contracts set out breach notification timings, evidence sharing and customer communication responsibilities before anything goes wrong.
What to do now
- Map where customer credentials live. Inventory every system storing customer passwords, especially legacy mail or portal products. Confirm they use a modern, salted, slow hashing algorithm, and retire services that cannot (Cyber Essentials: secure configuration).
- Restrict and monitor database access. Review service and integration accounts with read access to subscriber data, remove unused ones and alert on unusual bulk queries or exports (Cyber Essentials: user access control).
- Patch the platforms around the database. Customer portals, APIs and middleware are common entry points; keep them within the 14-day window for high and critical fixes (Cyber Essentials: security update management).
- Prepare for the phishing wave. Pre-draft customer warnings, publish how you will contact customers and brief support staff to expect impersonation.
- Test your notification clock. Run a tabletop exercise against the 72-hour UK GDPR deadline and, if you are a communications provider, the matching PECR deadline, including any white-label partners.
- Cut retention for former customers. Delete or archive leavers’ identity data and credentials as soon as contractual and legal needs allow.
Bottom line
Sony’s So-net breach is a reminder that the most damaging data in a customer database is often the least visible: forgotten mailbox passwords, partner customers and former subscribers. UK providers should assume their own subscriber platform is a priority target, watch it closely and be ready to notify regulators and customers quickly, well inside the statutory deadlines.
Sources
- Sony Network Communications: Notice of information leak following unauthorised access to the So-net member database (Japanese)
- BleepingComputer: Sony ISP subsidiary data breach exposes 2.5 million customer records
- CyberInsider: Sony discloses data breach exposing 2.6 million customer records
- Beebom: Sony data breach hits 2.58 million users, bank account details and passwords exposed
