Sony Network Communications has confirmed a data breach affecting roughly 2.5 million customer records, the Sony Group Corporation subsidiary said in an announcement. The company, which operates as an internet service provider in Japan, said its So-net member database supporting its internet access service was accessed by an unauthorized party. The intrusion occurred on October 19 and was detected four days later, prompting the company to shut down the compromised servers and cut off external communication.
The investigation confirmed that 2,585,481 customer records were exposed. Of those, 2,141,986 were So-net entries and 443,495 were plala (S Course) records. The plala portion affects NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services. An additional 54,401 email addresses from several email services were also exposed along with account passwords, and the company is advising users to change their passwords.
NTT Docomo has notified its own customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign. Those messages falsely claim recipients have won tickets and prompt them to enter personal information to claim them. Docomo said the incident affects all current Hikari service clients as well as those who canceled within the preceding six months.
Sony reported the incident to Japan's Personal Information Protection Commission and is investigating its cause and scope. As of October 27, neither company had confirmed misuse of the exposed data in the wild.
The breach adds to a string of cyberattacks against high-value companies and providers in Japan since the start of the year. GMO Internet Group and its Onamae Desktop Cloud service suffered a widespread malware attack on customer servers, telecommunications giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware. NTT was previously hit in early 2025 by hackers who gained access to its systems and stole data belonging to 18,000 corporate customers.
The pace of the incidents has drawn government attention, with Japanese officials holding urgent meetings on Monday to plan a response. The source article also referenced a separate incident at Nippon Columbia, described as a malware event exposing 8.6 million karaoke fan records.
More cybersecurity news from TechManNews.
