# Sony's So-net says an intruder took 2.6 million member records and 54,401 email passwords

Source: https://startwithidentity.com/blog/2026-10-27-sony-so-net-intruder-took-2-6-million-member-records-and-54401-email-passwords/
Last updated: 2026-10-27
License: content by Start with Identity. Cite the source URL.

---

Sony Network Communications, which runs the Japanese internet provider So-net, disclosed on October 27 that a third party accessed its member database without authorization on October 19. The company confirmed the access on October 23, shut down the server and blocked the attacker's traffic, and by October 24 had confirmed personal data was taken. The notice lists 2,141,986 So-net member records and 443,495 plala (S course) records, with names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. It also lists 54,401 email addresses together with their passwords, across the free G mail service, the paid A-Box and So-net VAIO Mail mailboxes and PostPet accounts, plus 16 bank account records. So-net reset those mail passwords on October 27, has reported the incident to Japan's Personal Information Protection Commission and is still investigating the cause.

## Why it matters

So-net's FAQ says that until the forced reset, whoever held the leaked passwords could read, send and receive mail as the account owner. That is the serious part. A mailbox is the [account recovery](https://startwithidentity.com/glossary/account-recovery/) channel for nearly every other account its owner holds, so whoever controls it can request password resets for banking, shopping and work logins. SecurityWeek reported the breach on October 29.

If you run a consumer service, expect [credential stuffing](https://startwithidentity.com/techniques/credential-stuffing/) with these addresses and treat password resets sent to them with extra suspicion for the next few weeks. Recovery that depends on email alone is weak; offer [passkeys](https://startwithidentity.com/glossary/passkey/) and a second recovery factor. Our [breach incident database](https://startwithidentity.com/breaches/incidents/) tracks how often stolen credentials, not exploits, open the door.

Source: [So-net (Sony Network Communications)](https://www.so-net.ne.jp/info/2026/20261027_0001.html)