{"id":2163,"date":"2026-10-29T07:18:52","date_gmt":"2026-10-29T00:18:52","guid":{"rendered":"https:\/\/vncybers.vn\/sony-ro-ri-2-58-trieu-ho-so-khach-hang-so-net-plala\/"},"modified":"2026-10-29T07:18:52","modified_gmt":"2026-10-29T00:18:52","slug":"sony-breach-2-58-million-so-net-plala-customer-records","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/sony-ro-ri-2-58-trieu-ho-so-khach-hang-so-net-plala\/","title":{"rendered":"Sony Confirms Breach of 2.58 Million So-net and plala Customer Records"},"content":{"rendered":"

V\u1ee5 r\u00f2 r\u1ec9 d\u1eef li\u1ec7u Sony Network Communications<\/strong> \u0111\u00e3 l\u00e0m l\u1ed9 2.585.481 h\u1ed3 s\u01a1 kh\u00e1ch h\u00e0ng hi\u1ec7n t\u1ea1i v\u00e0 tr\u01b0\u1edbc \u0111\u00e2y c\u1ee7a c\u00e1c d\u1ecbch v\u1ee5 So-net v\u00e0 plala (S Course) t\u1ea1i Nh\u1eadt B\u1ea3n. C\u00f4ng ty cho bi\u1ebft truy c\u1eadp tr\u00e1i ph\u00e9p x\u1ea3y ra ng\u00e0y 19\/10\/2026, \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n ng\u00e0y 23\/10 v\u00e0 c\u00f4ng b\u1ed1 ng\u00e0y 27\/10. Ngo\u00e0i d\u1eef li\u1ec7u th\u00e0nh vi\u00ean, m\u1eadt kh\u1ea9u c\u1ee7a 54.401 \u0111\u1ecba ch\u1ec9 email c\u0169ng n\u1eb1m trong ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng.<\/p>\n

Unauthorized Access Lasted Four Days Before Detection<\/h2>\n

According to Sony Network Communications, a third party gained unauthorized access to the So-net membership database on October 19. The company confirmed the incident on October 23, stopped the affected server, and blocked communications from the access source. An investigation the next day established that personal data had been taken.<\/p>\n

Sony reported the incident to Japan's Personal Information Protection Commission. The technical cause and full scope remain under investigation; as of October 27, the company had not confirmed secondary damage resulting from the exposed data.<\/p>\n

\"Data
Server infrastructure is a critical target in large-scale database intrusions. Photo: Taylor Vick\/Unsplash.<\/figcaption><\/figure>\n

What Was Included in the 2.58 Million Records?<\/h2>\n

The main scope covers 2,141,986 So-net records and 443,495 plala (S Course) records. The data may include names, phone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs. Both active customers and some people who canceled service from March 2026 onward are affected.<\/p>\n

Sony stressed that membership account passwords in this dataset were not exposed. Credit card information was also outside the confirmed scope, distinguishing the incident from a complete theft of payment data.<\/p>\n

54,401 Email Passwords and 16 Bank Records<\/h2>\n

A separate part of the incident affected 54,401 addresses across four So-net email services, with both the addresses and passwords taken. Sony reset those passwords on October 27 and asked users to create new ones through the official My Page portal.<\/p>\n

The notice also listed 16 bank account records containing the bank name, branch, account type, account number, and account holder's name. The company said it does not retain PINs, and no plala customers are included in this group of 16 records.<\/p>\n

Phishing Risk After the Data Leak<\/h2>\n

Although there is no evidence of misuse so far, the combination of names, phone numbers, email addresses, birth dates, and customer identifiers can make fraudulent emails, text messages, and calls more convincing. NTT Docomo, whose customers use plala (S Course), also warned about fake emails and websites designed to collect more personal information.<\/p>\n

Users should avoid links or attachments in unexpected messages, type support-site addresses themselves, and verify requests through official channels. Any exposed email password reused elsewhere must be replaced immediately with a unique password, and multi-factor authentication should be enabled where available.<\/p>\n

Responsibility for Former Customers' Data<\/h2>\n

The incident shows that data belonging to former customers can remain a long-term risk. The inclusion of 272,215 former So-net members and 21,130 former plala members raises clear questions about retention periods, purpose limitation, and procedures for deletion or anonymization.<\/p>\n

For businesses, data inventories must cover both active systems and legacy repositories. Database segmentation, least-privilege access, logging of unusual queries, and rehearsed server-isolation procedures can reduce impact when an intrusion occurs.<\/p>\n

What So-net and plala Users Should Do<\/h2>\n

Affected users should follow direct notices from Sony Network Communications or NTT Docomo, change passwords through the official site, and review email forwarding rules and unfamiliar sessions. The owners of the 16 identified bank accounts should monitor transactions and contact their bank if they see suspicious activity.<\/p>\n

Users should be cautious of anyone claiming to represent Sony, So-net, plala, or Docomo while requesting passwords, verification codes, or financial details. A message that contains the correct name or service ID may still be fraudulent if an attacker is exploiting leaked data.<\/p>\n

Lessons for Internet Service Providers<\/h2>\n

The incident highlights the cascading impact when one provider manages data for multiple brands and partners. A compromised database affects not only direct customers but also creates notification, support, and anti-impersonation duties for related organizations.<\/p>\n

Immediate priorities are to identify the entry point, check for persistence, revoke credentials, review all data queries, and disclose an evidence-based scope. Over the long term, retaining less data and encrypting sensitive fields can reduce the value of information if defenses are bypassed.<\/p>\n

VNCyberS<\/strong> compiled from Sony Network Communications, BleepingComputer, and Help Net Security<\/em><\/p>","protected":false},"excerpt":{"rendered":"

V\u1ee5 r\u00f2 r\u1ec9 d\u1eef li\u1ec7u Sony Network Communications \u0111\u00e3 l\u00e0m l\u1ed9 2.585.481 h\u1ed3 s\u01a1 kh\u00e1ch h\u00e0ng hi\u1ec7n t\u1ea1i v\u00e0 tr\u01b0\u1edbc \u0111\u00e2y c\u1ee7a c\u00e1c d\u1ecbch v\u1ee5 So-net v\u00e0 plala (S Course) t\u1ea1i Nh\u1eadt B\u1ea3n. C\u00f4ng ty cho bi\u1ebft truy c\u1eadp tr\u00e1i ph\u00e9p x\u1ea3y ra ng\u00e0y 19\/10\/2026, \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n ng\u00e0y 23\/10 v\u00e0 c\u00f4ng b\u1ed1 ng\u00e0y 27\/10. […]<\/p>\n","protected":false},"author":2,"featured_media":2162,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[784,1041,1039,1040,1038,315,1037,1036],"class_list":["post-2163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bao-mat-email","tag-bao-ve-du-lieu-ca-nhan","tag-lua-dao-phishing","tag-nhat-ban","tag-plala","tag-ro-ri-du-lieu","tag-so-net","tag-sony-network-communications"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2163"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2162"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}