Sony ISP breach exposes 2.59 million So-net customer records

Affected users should change their passwords, while the 2.59 million records themselves carry no banking or payment card data.

Sony Network Communications, a Sony Group subsidiary that runs an internet service business in Japan, disclosed that an unauthorised party reached its So-net member database and exposed about 2.59 million customer records. The data covers names, phone numbers, email addresses, user IDs, birth dates, gender and internet connection IDs, but no banking, payment card or other account details. A further 54,401 email addresses tied to several email services were exposed together with account passwords, so affected users are advised to change them. The breach began on October 19 and was spotted four days later, when the company shut the servers down and cut off outside communication. Of the total, 443,495 records belong to the plala S Course service, which serves NTT Docomo's Hikari internet customers, and Docomo has warned those customers about phishing mails. Sony has reported the incident to Japan's Personal Information Protection Commission, and as of October 27 neither company had confirmed that the data had been misused.