What leaked. 2,141,986 So-net records (1,869,771 current members and 272,215 who left from March 2026 on) and 443,495 records for plala (S Course), a fiber service So-net runs for NTT Docomo under contract. Both sets include names, phone numbers, email addresses, user IDs, birth dates, gender and internet connection IDs. Separately, the attacker got 54,401 email addresses together with their passwords across four paid and free mail services, plus 16 bank account records and 7 password-reset notices. Sony says no credit card data was touched and its NURO fiber service was not affected. How the attacker got in: Undisclosed, still under investigation.
Why it matters. Membership databases at ISPs are rarely treated as crown jewels, but this one held the login IDs people use to get online and, for 54,401 people, working email passwords. Those passwords were reset on Oct 27, but anyone who reused them elsewhere is exposed. Docomo is already warning about phishing that impersonates its d POINT Club and a fake Universal Studios Japan prize. It is also the third big Asian consumer-data breach this week, after GMO Onamae and the Korean finance wave.
What I'd do today. If you run a Japan subsidiary, flag so-net.ne.jp, plala and the listed mail domains in your phishing filters and help-desk scripts, because attackers now have names, birth dates and phone numbers to pass identity checks. Check whether any staff used those addresses for work accounts and force a reset. And if you outsource a customer service to a partner the way Docomo did, ask them in writing where your customers' records live and who can query them.