Sony Network Communications says unauthorized access to its So-net member database exposed 2,585,481 customer records, including current and former subscribers. Its October 27 notice also identifies 54,401 email addresses with their mailbox passwords, across four mail services.

Evidence status: provider-confirmed unauthorized access and data exposure. Sony dates the access to October 19, detection to October 23, and confirmation of the exposed data to October 24. It says it stopped the affected servers and blocked communication from the unauthorized source after detection.

The cause and full scope remain under investigation. Sony reports no confirmed secondary harm as of October 27. That is a dated observation, not proof that exposed credentials were never used.

Mailbox passwords are a specific subset of the exposure

The notice separates two customer-record populations:

  • 2,141,986 So-net records, including current subscribers and former subscribers who left from March 2026 onward.
  • 443,495 plala S Course records, with the same current/former distinction.

The listed fields include names, telephone numbers, email addresses, user IDs, birth dates, gender and internet-connection IDs. Those record totals are not an independently verified count of distinct people.

The mailbox-password exposure concerns Mail Service (G), A-Box additional mailboxes, So-net VAIO Mail and PostPet Mail Account Service. The 54,401 addresses are drawn from affected So-net members; adding them to the customer-record total would misstate the population.

Sony says passwords were not exposed in the two general member-information categories. Its incident FAQ further distinguishes the affected mail passwords from My Page login passwords, connection passwords and the basic free mailbox password, for which it reports no confirmed exposure.

That distinction matters operationally. Changing a member-portal password alone is a different action from resetting the affected mailbox’s send-and-receive password.

The primary notice includes 16 bank-account records

Bill Toulas’s October 28 BleepingComputer report says no banking or payment-card information was exposed. Sony’s linked notice gives a more specific account: it confirms 16 bank-account records were exposed.

That category includes financial-institution and branch details, account type, account number and account-holder name. Sony says it holds no bank PINs. It says the banking subset does not affect plala S Course members and that affected customers will receive individual contact.

The notice separately identifies seven password-reset notification records and says it initialized the relevant passwords. It states that credit-card information is absent from all listed categories. Banking exposure and credit-card exposure therefore need separate answers.

This is a discrepancy between the reporting and the primary notice available during review. It does not establish that bank accounts were accessed or funds stolen.

Reset the affected mail password, then update the mail client

Sony says it reset the affected mail-service passwords on October 27. The FAQ explains that exposed credentials could have allowed another party to read, send and receive email through mail software or So-net Web Mail. It does not publish a count of mailboxes actually accessed.

For an affected customer, the documented recovery path is:

  1. Open So-net’s official incident FAQ directly and follow the reset link for the particular mail service. Avoid unsolicited recovery links in email or SMS.
  2. Set the new mailbox password, then update the saved password in each mail client that uses it. Webmail-only users should confirm access with the new password.
  3. Allow for the stated propagation interval. The FAQ says changes commonly take minutes but can take up to 30 minutes to appear.
  4. Treat unexpected messages as a phishing risk. Sony warns against responding to suspicious email, SMS or calls, and against opening their links or attachments.

If the exposed password was reused elsewhere, replace it there as a separate defensive precaution. A mailbox used to recover other accounts also warrants reviewing unexpected reset messages and account changes. These precautions address possible follow-on access; the provider has not confirmed that such access occurred.

Caveat: the incident account and remediation status come from the affected provider; the public material leaves the entry point, password-storage format and actual downstream misuse unresolved.