Sony Network Communications has disclosed a data breach affecting about 2.58 million records, according to reporting by BleepingComputer and other outlets.
The company says unauthorized access to its So-net membership database began on October 19. It was discovered on October 23. Sony shut down the affected server and blocked traffic from the source of the access.
The exposed data covers 2,141,986 So-net member records and 443,495 plala records. Fields include names, phone numbers, email addresses, user IDs and dates of birth. Sony also identified 16 bank-account records containing institution names and account numbers. It says no PINs were involved and it found no evidence that credit card numbers or expiry dates were exposed.
Reports differ on credentials. One outlet says passwords linked to 54,401 email addresses across four email services were exposed. Sony's disclosure, as relayed by others, says passwords tied to the membership records were not leaked. Treat credential exposure as unconfirmed until the primary notice is checked.
The 2.58 million figure counts records, not distinct people. The 54,401 addresses are a subset of the same members. Sony says it has found no leaks affecting NURO or services outside those named.
Why it matters: names, birth dates, phone numbers and email addresses are enough to drive targeted phishing and account-recovery fraud against ISP customers. The gap between discovery and the October 19 start date is four days, which is short, but Sony has not said what the access path was.
Recommended actions. Affected customers should reset So-net and plala passwords and any reused credentials, and enable multi-factor authentication where offered. Defenders at organizations with staff on these services should brief users on phishing that quotes personal details, and watch for password-reset abuse. Review customer-database exposure in your own estate: access logging, egress monitoring, and how fast you can isolate a server.
