Sony Network Communications published a notice on 27 October, updated on the 29th, about unauthorised access to the member database behind its So-net internet service. The totals are large. What makes the notice worth reading is how precisely they are broken down.

The count, in the company's own breakdown

So-net member records: 2,141,986, split into 1,869,771 current members and 272,215 who left in March 2026 or later. plala S course records: 443,495, split into 422,365 current and 21,130 former. The two together come to 2,585,481. Anyone who left by the end of February 2026 is outside the affected set.

The fields are the same in both: name, telephone number, email address, user ID, date of birth, gender and internet connection ID. No passwords were in the member database, and the company says so explicitly rather than leaving it to be inferred.

Where the passwords were

Email passwords did go, but only for specific services, and the company gives a figure for each rather than one aggregate. The free mail service accounts for 24,655 addresses, the paid additional mailbox 17,672, the paid VAIO mail service 7,005 and the paid PostPet account service 5,069.

Those four add up to 54,401. The notice does not print that total, and the arithmetic is ours rather than theirs.

All of those passwords were reset by the company on 27 October. Basic So-net mailbox passwords were not leaked.

Sixteen bank records, listed separately

The entry that says most about the disclosure standard is the smallest one. 16 records of bank account information were exposed: financial institution name, bank code, branch name, branch code, account type, account number and account holder name.

Sixteen out of two and a half million is a rounding error in any summary, and it is reported anyway, with its field list. The company adds that it does not hold account PINs and that no bank information belonging to plala members was involved.

A separate line covers 7 password reset notification letters. No credit card information was involved in any category.

Four days from break-in to count

The attacker reached the member database on 19 October. The company confirmed the access on the 23rd, stopped the affected server and blocked the attacker's traffic. By the 24th it had established which fields and how many records had gone.

The cause is still under investigation. The incident has been reported to the Personal Information Protection Commission, a dedicated phone line is open, and individual notices are going to affected customers.

As of the notice, no secondary harm had been confirmed, and the company warns customers to expect contact that uses the leaked details.

What to take from it

  • Compare this against the breach notice you last received. Counting 16 bank records separately, naming each field, and publishing per-service password totals is a standard most disclosures do not meet.
  • Resetting the affected passwords the same day the notice went out is the part customers can act on.
  • The leaked set has names, dates of birth, phone numbers and connection IDs. That is enough for convincing contact from someone pretending to be the provider.
  • A figure a company does not publish is worth marking as your own arithmetic when you use it.

What is not established

  • How the attacker got in. The company says the cause is under investigation.
  • Whether the data has been used. No secondary harm was confirmed as of the notice.
  • Whether the affected set will grow. The company says the full scope is still being investigated.
  • Who the attacker is. The notice does not say.
  • Why 16 bank records were in the member database at all. The notice reports them without explaining their presence.