Vụ rò rỉ dữ liệu Sony Network Communications đã làm lộ 2.585.481 hồ sơ khách hàng hiện tại và trước đây của các dịch vụ So-net và plala (S Course) tại Nhật Bản. Công ty cho biết truy cập trái phép xảy ra ngày 19/10/2026, được phát hiện ngày 23/10 và công bố ngày 27/10. Ngoài dữ liệu thành viên, mật khẩu của 54.401 địa chỉ email cũng nằm trong phạm vi ảnh hưởng.
Unauthorized Access Lasted Four Days Before Detection
According to Sony Network Communications, a third party gained unauthorized access to the So-net membership database on October 19. The company confirmed the incident on October 23, stopped the affected server, and blocked communications from the access source. An investigation the next day established that personal data had been taken.
Sony reported the incident to Japan's Personal Information Protection Commission. The technical cause and full scope remain under investigation; as of October 27, the company had not confirmed secondary damage resulting from the exposed data.
What Was Included in the 2.58 Million Records?
The main scope covers 2,141,986 So-net records and 443,495 plala (S Course) records. The data may include names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Both active customers and some people who canceled service from March 2026 onward are affected.
Sony stressed that membership account passwords in this dataset were not exposed. Credit card information was also outside the confirmed scope, distinguishing the incident from a complete theft of payment data.
54,401 Email Passwords and 16 Bank Records
A separate part of the incident affected 54,401 addresses across four So-net email services, with both the addresses and passwords taken. Sony reset those passwords on October 27 and asked users to create new ones through the official My Page portal.
The notice also listed 16 bank account records containing the bank name, branch, account type, account number, and account holder's name. The company said it does not retain PINs, and no plala customers are included in this group of 16 records.
Phishing Risk After the Data Leak
Although there is no evidence of misuse so far, the combination of names, phone numbers, email addresses, birth dates, and customer identifiers can make fraudulent emails, text messages, and calls more convincing. NTT Docomo, whose customers use plala (S Course), also warned about fake emails and websites designed to collect more personal information.
Users should avoid links or attachments in unexpected messages, type support-site addresses themselves, and verify requests through official channels. Any exposed email password reused elsewhere must be replaced immediately with a unique password, and multi-factor authentication should be enabled where available.
Responsibility for Former Customers' Data
The incident shows that data belonging to former customers can remain a long-term risk. The inclusion of 272,215 former So-net members and 21,130 former plala members raises clear questions about retention periods, purpose limitation, and procedures for deletion or anonymization.
For businesses, data inventories must cover both active systems and legacy repositories. Database segmentation, least-privilege access, logging of unusual queries, and rehearsed server-isolation procedures can reduce impact when an intrusion occurs.
What So-net and plala Users Should Do
Affected users should follow direct notices from Sony Network Communications or NTT Docomo, change passwords through the official site, and review email forwarding rules and unfamiliar sessions. The owners of the 16 identified bank accounts should monitor transactions and contact their bank if they see suspicious activity.
Users should be cautious of anyone claiming to represent Sony, So-net, plala, or Docomo while requesting passwords, verification codes, or financial details. A message that contains the correct name or service ID may still be fraudulent if an attacker is exploiting leaked data.
Lessons for Internet Service Providers
The incident highlights the cascading impact when one provider manages data for multiple brands and partners. A compromised database affects not only direct customers but also creates notification, support, and anti-impersonation duties for related organizations.
Immediate priorities are to identify the entry point, check for persistence, revoke credentials, review all data queries, and disclose an evidence-based scope. Over the long term, retaining less data and encrypting sensitive fields can reduce the value of information if defenses are bypassed.
VNCyberS compiled from Sony Network Communications, BleepingComputer, and Help Net Security
Tiếng Việt
English