Sony Data Breach Exposes 2.5 Million So-net and Plala Users

Somewhere on the night of October 19, someone got into the servers behind two of Japan's oldest internet providers and walked out with personal records on more than 2.5 million people. Sony confirmed the breach this week, and the details are messier than a typical "names and emails" leak.

What actually got taken

The breach hit Sony Network Communications, the parent company behind So-net and Plala, two internet service providers (ISPs, the companies that sell you your home broadband connection) that have been running in Japan since the dial-up era. Between the two services, Sony says around 2.58 million records were accessed.

• Names, phone numbers, email addresses, and dates of birth tied to current and former So-net members
• A separate batch of plala subscriber records
• Roughly 54,000 email address and password combinations, some of which were apparently stored or transmitted in a way that let the attacker read them

Sony says it hasn't found evidence that payment card numbers were part of the haul, which is the one mercy here. But a password leak is arguably worse for an ordinary user than a stolen card number — a card gets cancelled and reissued in a day, while a reused password quietly unlocks every other account where someone typed the same one.

The part that should worry people more than the headline number

What makes this breach interesting isn't the 2.5 million figure by itself — plenty of breaches post bigger numbers. It's that Sony, a company that runs security-sensitive services like the PlayStation Network, still had an ISP subsidiary where credentials weren't handled in a way that kept them unreadable if the database was ever touched. That's a basic hygiene failure, not an exotic attack.

A breach that exposes a password in plain, readable form isn't really a breach of one account — it's a breach of every account where that person got lazy and reused it.

Sony has reported the incident to Japan's Personal Information Protection Commission and is telling affected users to change their passwords, but as of its disclosure it hadn't said publicly how the attacker got in — no confirmed phishing email, no named software flaw, no claimed group taking credit.

Why this matters if you've never used So-net or Plala

Nobody in India has a So-net broadband connection, but the pattern here is one Indian readers run into constantly: an old, back-office system holding login data for millions of people, built years before anyone treated password storage as a serious design problem. Indian telecom and broadband subscriber bases run into the hundreds of millions, and more than a few of those providers are running infrastructure of a similar vintage.

It's also a useful test case for how India's own rules would have handled this. Under the Digital Personal Data Protection (DPDP) Act, a company that suffers a breach of this scale would be required to notify India's Data Protection Board and the affected users, and the clock for that notification starts the moment the breach is discovered — not whenever it's convenient to disclose. Sony's own timeline, where the intrusion happened on October 19 and the public disclosure landed over a week later, is the kind of gap that regulators in both Japan and India are increasingly impatient with.

What to actually do about it

If you've ever reused a password across a Sony service, an old ISP account, or honestly any site you signed up for before 2020, this is as good a prompt as any to go fix it. A few concrete steps:

1. Turn on a password manager if you don't already use one, and stop reusing passwords across sites
2. Enable two-factor authentication wherever it's offered, especially on email and financial accounts
3. Check whether your email shows up in breach-tracking tools like Have I Been Pwned, and change the password immediately if it does

None of that undoes a breach that's already happened. But the real lesson from Sony's week isn't about one ISP in Japan — it's that even companies with serious security budgets still get caught storing credentials the easy way instead of the safe way, and the fix for that is on the user's side as much as the company's.