Sony ISP subsidiary breach exposes about 2.5 million customer records

Japan's Sony Network Communications, a subsidiary of Sony Group Corporation, has confirmed a data breach that compromised roughly 2.5 million records containing personal information of current and former customers. The company provides telecommunications and technology services and operates as an internet service provider in Japan.

What happened

The breach took place on October 19 and was detected four days later. The company then shut down the compromised servers and blocked external communication. According to Sony Network Communications, an unauthorized party accessed the So-net member database that supports its internet access service.

The investigation found that 2,585,481 records were exposed. They include:

• full names;
• phone numbers;
• email addresses;
• user IDs;
• dates of birth;
• gender;
• internet connection IDs.

The company says no banking, payment card or other account details were exposed. However, another 54,401 email addresses from several email services were leaked along with their account passwords. Users are advised to change their passwords.

NTT Docomo customers affected too

Of the total, 2,141,986 records belong to So-net and 443,495 to plala (S Course). The latter concern customers of another provider, NTT Docomo, which contracts Sony Network Communications to deliver its Docomo Hikari services.

NTT Docomo has also notified its customers. It warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign, telling recipients they have "won" and asking them to enter personal information to claim tickets. Docomo says the incident affects all current Hikari customers as well as those who cancelled within the preceding six months.

Sony has reported the incident to Japan's Personal Information Protection Commission and is investigating its cause and scope. As of October 27, neither company had confirmed misuse of the exposed data in the wild.

A wave of attacks in Japan

Since the start of the year, high-value Japanese companies and providers have repeatedly been targeted by cyberattacks. Among the recent cases is the incident at GMO Internet Group, where customer servers of its Onamae Desktop Cloud service were hit by a widespread malware attack. Telecom giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was hit by ransomware. In early 2025, hackers breached NTT's systems and stole data belonging to 18,000 corporate customers.

The pace of breaches is so unprecedented that the Japanese government held urgent meetings on Monday to plan its response.

Source: Bleeping Computer