Sony So-net Data Breach: 2.58 Million Records Leaked, Including Ex-Members

Last checked: Oct 27, 2026. Based on Sony Network Communications official notice.

On October 27, 2026, Sony Network Communications, the Sony Group company behind the Japanese internet provider So-net, disclosed that a third party gained unauthorized access to its So-net member database on October 19, 2026. The company noticed the breach on October 23, immediately stopped the server and blocked access, then confirmed the information leak on October 24.

The breach exposed 2,585,481 member records (2,141,986 So-net members and 443,495 plala S course members), including 293,345 records belonging to people who had already canceled their accounts.

Here's what was leaked, who was affected, and what you should do if you're one of them.

#What data was exposed

According to Sony Network Communications' October 27, 2026 notice, the breach exposed the following information:

#What was not leaked

Sony Network Communications confirmed that:

• Member account passwords were not leaked
• Credit card data was not involved
• No leak was confirmed for NURO or other Sony Network Communications services

#Email passwords leaked

54,401 email addresses together with their email passwords were leaked across four So-net mail services:

• Mail Service (G): 24,655 records
• A-Box: 17,672 records
• So-net VAIO Mail: 7,005 records
• PostPet Mail: 5,069 records

So-net force-reset all 54,401 email passwords on October 27, 2026. Affected users must set a new password through My Page on the So-net website.

#Former members were affected

Here's what should worry everyone: 293,345 of those records belonged to people who had already canceled their So-net or plala accounts.

That breaks down to:

• 272,215 former So-net members who canceled from March 2026 onward
• 21,130 former plala members who canceled from March 2026 onward

People who canceled by the end of February 2026 were not affected.

#Why So-net keeps data after cancellation

According to So-net's official FAQ about the breach, the company keeps member information for a certain period after cancellation for final-month billing and inquiries. The FAQ states (translated):

"We retain information for a certain period after cancellation for final-month billing and inquiries."

In other words: quitting a service isn't the same as deleting your data.

#Timeline of the breach

Sony Network Communications reported the breach to Japan's Personal Information Protection Commission. As of October 27, 2026, the company says no secondary harm has been confirmed, though the cause remains under investigation.

#Does canceling an account delete your data?

The So-net breach shows a reality that catches many people off guard: companies often keep your account data for a period after you cancel.

The reasons vary. Companies may keep data for:

• Final billing and payment processing
• Customer support inquiries about past accounts
• Legal and compliance requirements (tax records, dispute resolution)
• Internal analytics and reporting

Some of these reasons are legitimate. Others are not. And the retention periods vary wildly, from 30 days to years, depending on the company and jurisdiction.

#What you can do

Here are practical steps you can take:

1. Ask companies to delete your data after you cancel. Where privacy law gives you that right (for example, GDPR in Europe or CCPA-style deletion rights in some US states), submit a deletion request after canceling. Not every company is covered, and not every request will be honored, but it's worth asking.

2. Close old email accounts you no longer use. An abandoned email account linked to breached services can become a phishing target for years.

3. Change passwords you reused. If you used the same password on multiple sites, change it everywhere else. Breached credentials from one service are often tried on others.

4. Watch for phishing that mentions the breach. After a breach is disclosed, expect fake emails, texts, or calls pretending to be from the company. Don't click links or respond to unexpected messages. Go to the official site yourself.

These steps won't guarantee your data is deleted, but they reduce the risk of it being misused after a breach.

#What to do if you're affected

If you have or had a So-net or plala account:

1. Reset your So-net mail password if you used Mail Service (G), A-Box, So-net VAIO Mail, or PostPet Mail. Do this through the official My Page on the So-net website, not through any link in an email.

2. Don't respond to unexpected messages. Sony Network Communications warns that affected members may receive suspicious emails, SMS, or phone calls. Don't click links, open attachments, or provide personal information in response.

3. Change passwords you reused. If you used your So-net email password on other sites, change those passwords too.

4. Watch your accounts for unusual activity, especially if your email address or phone number was leaked.

#Sources

All facts in this article come from the following sources:

• So-net / Sony Network Communications, "So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ" (Oct 27, 2026)
• So-net Support FAQ, "So-net会員データベースへの不正アクセスに関するご質問と回答" (Oct 2026)
• ITmedia NEWS, "So-net、会員情報約259万件が漏えい" (Oct 27, 2026)
• Yomiuri Shimbun (Oct 27, 2026)
• CyberInsider, "Sony discloses data breach exposing 2.6 million customer records" (Oct 27, 2026)
• INTERNET Watch (Oct 27, 2026)

#Keep your data off data brokers

Your name, address, and phone number can sit on people-search sites long after you've left a service.

UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.

---

Not affiliated with Sony or So-net.