Sony's Japanese internet arm lost 2.58 million member records, and 54,401 email passwords with them

Sony Network Communications published the apology on 27 October. Someone got into the member database behind So-net, the Japanese internet provider it owns, on 19 October. Staff spotted it on 23 October and pulled the server offline, and by the 24th they had worked out how much had gone: 2,141,986 So-net member records and 443,495 from plala's S Course, 2,585,481 in total.

Each record holds a name, phone number, email address, user ID, date of birth, gender and the identifier for the internet connection itself. Account login passwords were not in there, and neither were card numbers. Sixteen bank account records were, along with the passwords to 54,401 mailboxes on So-net's email services. Sony reset every one of those on the 27th, so the people affected now have to set a new one through their account page before their mail works again.

The detail worth sitting with is the 293,345 former members in that count. People who cancelled their broadband years ago, moved on, forgot the account existed, and whose date of birth and phone number were still sitting in a live database in October 2026. Closing an account almost never means the record goes away, and that is not a Sony quirk.

If a mailbox password was stored in a way that let the provider reset it on your behalf, assume anything you reused it on is now a problem too. The scam calls will follow, because whoever has this list can open with your connection ID and your birthday. Tendvane's Privacy and accounts check runs the email addresses you give it against known breach collections, which at least tells you which of your addresses are already in circulation.