Sony So-net Breach Exposes 2.6 Million Customers, Plus 54,000 Email Passwords

What happened at So-net

Sony Network Communications disclosed on October 27 that its So-net member database had been breached. The intrusion happened on October 19 and was detected four days later, on October 23. About 2.6 million current and former customers were exposed: 2,585,481 records across So-net and plala, plus 54,401 email passwords.

That combination is what makes this breach worse than a typical customer list leak. Names and account details enable phishing. Email passwords enable account takeover, especially for people who reused the same password elsewhere. Sony has not said exactly which fields were in each record, and customers should assume the worst until the company gives a clearer breakdown.

The So-net disclosure was the largest confirmed breach of October by record count, according to a month-end recap of security incidents. It arrived in a month already crowded with serious events, from supply chain compromises to ransomware taking down a national cloud region. October did not lack for warnings. The question, as always, is who acts on them.

Why the four-day detection gap matters

An intrusion on October 19 that was detected on October 23 gave attackers four days inside. That is enough time to explore, copy data, and cover tracks. Detection speed is one of the few numbers that genuinely predicts breach severity, and four days is not terrible by industry standards, but it is not good either. Many intrusions are found in hours now, and the best-run operations find them in minutes.

For customers, the timeline has a practical consequence. If you used So-net or plala, assume your data has been circulating for over a week by the time you read the disclosure. Change your So-net password, and change it anywhere else you reused it. Turn on two-factor authentication where it is offered. Then watch for phishing messages that use your real details, because breach data makes fake messages much more convincing.

This is the same advice that follows every major breach, and it keeps being necessary because password reuse keeps being common. A password manager removes the excuse. If setting one up feels like a chore, our guide to setting up a password manager in 30 minutes walks through it step by step, and it is the single highest-value security task most people can do this week.

The wider October pattern

The So-net breach did not happen in isolation. The same October recap noted the University of Copenhagen reporting an intrusion into a test environment with data on about 525,000 people, including national ID numbers, with PIN codes reissued for 20,000 ID cards. Test environments keep appearing in breach reports because they are often guarded less carefully than production systems while still holding real data. If your organization keeps real customer data in a test system, that is a problem to fix this week, not next quarter.

Other October incidents show the same lesson from different angles. Quest Diagnostics disclosed a breach of its patient test ordering system, and a third-party breach halted trading at Polymarket after about 2.7 million dollars was drained from users. The common thread is not one technique or one attacker. It is that data held by someone else, whether a vendor, a test system, or a partner, can hurt you just as much as data on your own servers.

Ransomware claims also kept coming through the month, including a claim listing 15.4 million accounts at Gamdom that should be treated as a claim rather than confirmed fact. The distinction matters: a claim on a group's site is not proof of a breach, but it is still a reason to check your own exposure. So-net, by contrast, is a confirmed company disclosure, which puts it on firmer ground and makes the customer advice more urgent.

What companies should take from this

Three lessons stand out for anyone running a service with customer data. First, know where your customer records actually live, including old brands and acquired systems. So-net's exposure spanned So-net and plala, a reminder that legacy databases from mergers and rebrands are still live targets even when nobody on the current team thinks about them daily.

Second, protect email credentials as if they were the keys to everything, because they are. An email account is the reset path for most other accounts. Storing email passwords in a form attackers can use, rather than salted and hashed, turns a database leak into a wave of takeovers. If your system still stores passwords in a reversible format, that is the fix to prioritize.

Third, detection and disclosure speed are part of the product now. Customers judge a breach response almost as much as the breach itself. A clear statement of what was taken, who is affected, and what to do next beats vague reassurance every time. Sony's disclosure gave concrete numbers, which is the right instinct. The missing piece is field-level detail, and affected customers deserve that follow-up.

What to do if you are affected

Start with passwords: change your So-net and plala passwords, then change any other account that shared them. Enable two-factor authentication on your email account first, since that protects the reset path for everything else. Review your email account for forwarding rules or filters you did not create, a classic sign of a compromised mailbox.

Then expect phishing. Messages that mention So-net, your plan, or your account details should be treated with suspicion even when they look polished. Do not click links in unexpected messages about the breach. Go to the provider's site directly instead. And if you reused your So-net password on a financial or work account, change that one immediately, before anything else on the list.

The So-net data breach is a reminder that even large, established providers lose customer data, and that the damage depends less on the headline number than on what was in the records and how fast people act. Two point six million records is a big number. Fifty-four thousand email passwords is the part that should make you move today.