EXPLORINEER
en

JP — ITmedia

So-net Leaks Data of About 2.59 Million Members; Passwords Also Exposed for Some Email Services

Security1 min read

Sony Network Communications, the company behind the So-net internet service, says hackers got into its member database. About 2.59 million member records leaked, and about 54,000 email addresses and passwords were also exposed.

What happened

Sony Network Communications said that someone outside the company broke into the member database for its So-net internet service. Records of about 2.59 million members leaked. The list includes people who have already left the service. For some email services, email addresses and passwords also leaked. The company has reset those passwords and asked users to set new ones.

Key numbers and facts

  • Total leaked member records: about 2,585,481
  • So-net member records: 2,141,986
  • plala (S course) member records: 443,495. This is a service for Docomo Hikari internet users.
  • Email addresses and passwords leaked: about 54,401, from 4 email services
  • Bank account details leaked for 16 accounts, and 7 password-reset notices. Bank PIN codes were not included.

Some background

So-net is an internet connection service. Many people use it for home internet and email. A member database stores personal details such as names, phone numbers, and birth dates. When a company stores this kind of data, hackers may try to steal it. Passwords and bank details are especially risky, because they can be used to get into accounts or take money.

Why it matters

Leaked personal details can be used in scam emails and text messages that look real. The company says it has not yet seen any harm from the leak. Still, users should be careful with unexpected messages. The company says it did not leak passwords for member accounts or credit card information, but email passwords for some services were exposed.

What to watch

  • Whether the company finds out how the hackers got in and how far the damage spreads
  • What the Personal Information Protection Commission decides after getting the company's report
  • Any new scam emails or text messages that use the leaked information
  • Whether users reset their email passwords as the company asked

Glossary

So-net
An internet connection service run by Sony Network Communications.
Sony Network Communications
A Japanese company that provides internet and network services, including So-net and NURO Hikari.
plala
A home internet service for Docomo Hikari users that can use So-net's connection settings.
Personal Information Protection Commission
A Japanese government group that watches over how companies protect personal information.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

Securityheise online

Security: Apple patches many holes again – including for older operating systems

Apple has fixed numerous security vulnerabilities across its operating systems, with over 150 listed in the release notes for iOS 27.2, macOS 27.2 and iPadOS 27.2. Security firm Calif.io, which has been credited several times, also released the first untethered iPhone jailbreak in years for devices up to iOS 27.0.1 and iOS 27.1, and plans to publish the details. Updates for older systems, including iOS 26.7.2, iOS 18.7.11 and macOS 26.7.2 and 15.8.2, are also available.

SecurityITmedia

GMO Offers Bounty of About 150 Million Yen for Clues to Unauthorized Access Perpetrators

GMO Internet Group announced on October 27, 2026 a reward program with a total of US$1 million (about 150 million yen) for information that helps clarify the unauthorized access to "Onamae.com Desktop Cloud," a VPS for automated FX trading offered by subsidiary GMO Internet. Information submissions open at noon on October 28 through a dedicated channel, and the program will continue until the culprits are arrested. The company says the reward is a maximum total for the entire program, not a per-person payment, and that payments will not be made to perpetrators or to those who obtained information illegally.

Security전자신문

[AI Guarding AI] Microsoft Extends Project Perception to Protect Internal AI Agents, Not Just External Threats

Microsoft says AI security must now cover internal AI agents that access enterprise data, tools, and systems, not only external AI-powered attacks. Its Project Perception, unveiled in July, combines signals, security context, models, and specialized Red, Blue, and Green agents into a continuously learning defense system, with humans retaining final control over key decisions. The company also describes "agentic insiders," offers layered protection and dynamic risk scoring, and provides traceability so security teams can monitor agent behavior and adjust policies.

SecurityITmedia

GMO Confirms Attacker Published Information; Investigating Whether Customer Data Is Included, Considering Additional Condolence Payments

GMO Internet Group said that at 12:30 p.m. on October 27 it confirmed the publication, apparently by an attacker, of information that appears to concern customers, related to unauthorized access to its FX auto-trading VPS "Onamae.com Desktop Cloud." The company is still investigating the contents, which may include inaccurate information, and is considering additional condolence payments for affected users whose information was published, beyond the flat 5,000-yen payment announced earlier.