Sony Network Communications said in a notice dated 27 October 2026 (in Japanese) that the member database of its So-net internet service was accessed without authorisation from outside on 19 October; it confirmed the access on 23 October, stopped the affected server and cut off communications from the source, and on 24 October established that personal information had leaked. The company lists 2,141,986 So-net member records (1,869,771 current members and 272,215 former members who left in March 2026 or later) and 443,495 plala (S Course) member records (422,365 current and 21,130 former), covering name, phone number, email address, user ID, date of birth, gender and internet connection ID, and says no passwords were leaked from these records.

Separately, it confirmed the leak of 54,401 email addresses together with their mailbox passwords across four mail services (Mail Service (G) 24,655, A-Box 17,672, So-net VAIO Mail 7,005 and PostPet mail account service 5,069), which it reset on 27 October, as well as 16 bank account records (it says it holds no account PINs) and 7 password-reset notice records.

The company says none of the leaked data includes credit card information, that it has not confirmed any leak from NURO or its other services, and that people who left by the end of February 2026 are not affected.

It gives the cause as unauthorised access by a third party (under investigation), says it has reported the incident to Japan's Personal Information Protection Commission, and says that, as far as it knew on 27 October, no secondary damage had been confirmed.

Help Net Security reported the notice on 28 October.