Sony Network Communications said on 27 October 2026 that an outside party accessed the member database of its So-net internet service on 19 October. The leak covered 2,141,986 So-net member records and 443,495 records of customers of NTT Docomo’s plala (S course) service, which the database also held.
By our arithmetic, that is 2,585,481 records. The company also confirmed that 54,401 email addresses leaked together with their passwords, along with 16 bank-account records, in a notice on So-net’s site. NTT Docomo published its own notice the same day.
Short explainer · So-net’s 2.59M-record leak
A vertical news Short narrated from the published headlines and opening lines of this piece and three related FourWeekMBA security pieces.
Business Pill · Embedded dependency
An evergreen Business Engineer explainer on what sits inside what you buy. It explains the general idea and does not discuss So-net or Docomo.
The key insight: As we read it, the notices show one contractor database carrying two brands: So-net’s own members and NTT Docomo’s plala (S course) customers, which is why one break-in produced two companies’ disclosures on the same day.
The So-net member records cover 1,869,771 current members and 272,215 former members who left in or after March 2026, the notice says. They include name, phone number, email address, user ID, date of birth, gender and internet connection ID. The company says no passwords leaked from these records.
Separately, the email addresses and passwords of 54,401 mailboxes leaked across four So-net mail services: 24,655 on a free mail service, 17,672 on the paid A-Box extra mailbox, 7,005 on So-net VAIO Mail and 5,069 on the PostPet mail account service.
The company also lists 16 bank-account records (bank name and code, branch name and number, account type, account number and holder name) and 7 records of notices issued for password resets. It says it does not hold account PINs, that none of the leaked data includes credit-card information and that it has found no leak in other services, including NURO.
Member records leaked from the So-net member database, by brand: 2,141,986 So-net records (1,869,771 current, 272,215 former members who left since March 2026) and 443,495 records of NTT Docomo’s plala (S course) customers (422,365 current, 21,130 former). Source: So-net and NTT Docomo notices, 27 October 2026. The two brands are shown side by side, not merged.
What Was Posted on X
โผ๏ธ BREAKING: Sony Net was hacked, leaking 2.58M member records.
Names, birth dates and phone numbers leaked, plus 16 bank account records and passwords to 54,401 email accounts.
The break-in was on October 19. So-net spotted it four days later.
— International Cyber Digest (@IntCyberDigest) Oct 27 15:23
International Cyber Digest posted at 15:23 UTC on 27 October that Sony Net was hacked, leaking 2.58M member records, with names, birth dates and phone numbers, 16 bank-account records and passwords to 54,401 email accounts, and that So-net spotted the 19 October break-in four days later. Its counts match So-net’s notice, which gives the member records as 2,141,986 So-net and 443,495 Docomo plala (S course) records.
Four Days to Spot It
What leaked from the So-net member database: 2,141,986 So-net and 443,495 Docomo plala (S course) member records (2.59M by our arithmetic), 54,401 email addresses with passwords and 16 bank-account records. Accessed 19 October, confirmed 23 October. Source: So-net and NTT Docomo notices, 27 October 2026.
According to the notice, the database was accessed from outside on Monday 19 October. The company confirmed the access on Friday 23 October, stopped the affected server and cut off traffic from the source, and on 24 October established which items had leaked and how many.
It lists the cause as unauthorised access by a third party, still under investigation. It says it has reported the incident to Japan’s Personal Information Protection Commission and is investigating the cause and full scope.
NTT Docomo says it received the report from Sony Network Communications on Monday 26 October and confirmed the leak, one day before both companies published their notices.
The Docomo Contractor Link
So-net member records leaked: 2,141,986 So-net records, then 2,585,481 once the 443,495 records of NTT Docomo’s plala (S course) customers are added (our arithmetic). Source: So-net and NTT Docomo notices, 27 October 2026.
Docomo’s notice says the server accessed was the So-net member database server of Sony Network Communications, a company NTT Docomo outsources work to. The leak covers 443,495 current customers of Docomo Hikari’s plala (S course) and those who cancelled within the past six months.
Docomo says customer data for its other plala services, such as plala (Docomo Hikari) and Purara Hikari Mate with Flets, did not leak. The So-net notice gives the plala (S course) split as 422,365 current and 21,130 former members.
For plala (S course) customers, Docomo lists name, phone number, so-net.ne.jp email address, contact email address where registered, date of birth, gender, the user ID for logging in to So-net’s My Page and the internet connection ID. It says passwords, card data and bank-account data are not included.
What Customers Are Told
So-net says it reset the passwords of the 54,401 affected mailboxes on 27 October and asks those customers to set new ones through its My Page. It says it will contact affected customers individually.
Both companies say no secondary damage from the incident had been confirmed as of 27 October. Both warn that the leaked data could be used in suspicious contacts, and ask customers not to answer such emails, SMS messages or calls, not to open links in them and not to open attachments.
As we read it, the gap between access and detection is the company’s own timeline: the database was accessed on 19 October and the access was confirmed on 23 October, with the scope set on 24 October.
As we read it, the client learned last: Docomo says it was told on 26 October, two days after So-net had established which items leaked and how many.
As we read it, the passwords that leaked were mailbox passwords, not member-account passwords: So-net says no passwords leaked from the member records, and it reset the 54,401 mailbox passwords on 27 October.
International Cyber Digest on X, 27 October 2026
“The break-in was on October 19. So-net spotted it four days later.”
Three Implications
FOR SO-NET AND PLALA (S COURSE) CUSTOMERS Both companies warn that the leaked names, phone numbers and email addresses could be used in suspicious emails, SMS messages and calls.
FOR COMPANIES THAT OUTSOURCE CUSTOMER SYSTEMS Docomo’s customer records sat in its contractor’s So-net member database, and the leak reached Docomo through that contractor.
FOR JAPAN’S REGULATOR So-net says it has reported the incident to the Personal Information Protection Commission and that the cause is still under investigation.
The framework puts it this way: “This is the Embedding Mental Model: enterprise vendors don’t sell software anymore—they sell irreversibility.”
As we read it, the So-net case shows the same embedding from the risk side: Docomo’s plala (S course) customer records lived in a contractor’s member database, so the contractor’s breach became Docomo’s disclosure. The framework was written in December 2025 about enterprisesoftware and does not discuss So-net, Docomo or data breaches.
What Is Not Established
The two notices do not say how the attacker got in, who the attacker was, or whether the leaked data has been published or offered for sale. So-net lists the cause as under investigation.
The records are counted per record in the notices, and the notices do not say how many individual people they cover. The 2,585,481 total is our sum of the two member-record counts; it does not add the mailbox, bank-account or notice records.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
So-net says one member database, accessed on 19 October and checked four days later, held both its own members and Docomo’s plala (S course) customers, and that 2,141,986 and 443,495 of their records leaked, with 54,401 mailbox passwords.
A note on sourcing. The figures and dates are from the Japanese-language notices published on 27 October 2026 by Sony Network Communications (So-net) and NTT Docomo, which we read in full and paraphrase in English; Keitai Watch reporting of the same day adds context. Figures labelled “by our arithmetic” are ours. This piece covers the incident at a business level and does not describe attack methods.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
