The Sony Data Breach Exposed 2.6 Million Names, Emails And Birthdays

November 2, 2026 · 7 min read

A So-net customer in Japan opened a message last week that appeared to come from d POINT Club. It greeted them by their full name, quoted their date of birth back to them as a security check, and asked them to confirm their account. The page it led to was fake. Every detail that made it convincing was real. All of it came out of the Sony data breach eight days earlier.

Confirmation: confirmed by Sony Network Communications in a company announcement dated October 27, 2026.

The Sony data breach is a Japanese incident, and most American readers are not in this file. The pattern is the part that travels. A company loses a list, and the list is what makes the next message believable.

What happened in the Sony data breach

Sony Network Communications operates as an internet service provider in Japan under the So-net brand. BleepingComputer reported on October 28 that attackers reached its systems on October 19. The company detected the intrusion four days later, then shut down the affected servers and cut their outside connections.

Sony published its findings on October 27. Its investigation confirmed the exposure of 2,585,481 customer records. That total breaks into 2,141,986 So-net entries and 443,495 records from the plala S Course service, which NTT Docomo contracts out to Sony. Docomo says the incident affects every current Hikari service customer, plus anyone who canceled in the previous six months.

Sony reported the incident to Japan’s Personal Information Protection Commission. As of October 27, neither company had confirmed any misuse of the stolen data.

What was exposed, and what each item is worth to an attacker

Sony listed seven data types in the exposed records. Each one does a specific job in a scam.

Full names — they let a message open with your real name instead of “Dear customer.”
Phone numbers — they move the attack to SMS, where there is no spam folder and no sender address to inspect.
Email addresses — the delivery route, and the thing the rest of the file is attached to.
User IDs — they let a fake login page prefill your account and look like it already knows you.
Dates of birth — the answer to a common identity check, and a convincing detail to quote.
Gender — small on its own, useful for tailoring the wording.
Internet Connection IDs — they tie you to a specific service, so a message about “your connection” is accurate.

Sony says those records held no banking details, payment card numbers and no other account details.

A separate 54,401 accounts also lost passwords

Alongside the main file, the company disclosed that attackers also took 54,401 email addresses from several of its mail services, together with their account passwords. Sony’s announcement does not say whether those addresses sit inside the 2,585,481 figure or beside it.

That smaller group carries the heavier risk. Someone can try an address and a password together anywhere else the same pair appears. Attackers run those lists against banks, shops and other mailboxes within days, because the work is cheap and the hit rate only has to be small.

Why the Sony data breach brings a phishing wave next

NTT Docomo did not wait for evidence of misuse before warning customers. It has told them to expect phishing emails and fake websites impersonating its d POINT Club program and a Universal Studios Japan campaign.

That sequence repeats after almost every list like this. The breach happens at one company, and the bill arrives in your inbox as mail from strangers who now know enough about you to sound legitimate. For a notable share of people, the breach itself causes no direct loss, but the follow-up message does.

What to do now

Most of this has nothing to do with us, so here it is plainly.

1. Treat mail about this breach as suspect. Go to the company by typing its address yourself. Do not use a link or a phone number from a message that arrived unprompted. 2. Change a reused password today. If you used a So-net or plala password anywhere else, that reuse is the live problem. Start with your email, then your bank. 3. Use a password manager. It makes unique passwords practical, which is what breaks the reuse chain. 4. Turn on the strongest sign-in each account offers. Passkeys where you can get them, an authenticator app otherwise, and SMS codes last. 5. Be skeptical of accurate details. Your name, birthday and connection ID in a message prove the sender bought a list. They do not prove the sender is real.

How OptMsg changes this exposure

OptMsg would not have stopped the Sony data breach. It happened at an internet provider, on servers we have nothing to do with. What an OptMsg inbox changes is what the leaked file can do next, so here is that argument at its real size.

Your OptMsg account has no password. So when a site you signed up to gets breached, the attacker ends up holding your address and that site’s password, and that pair cannot open your OptMsg inbox because there is no password on it to match. Since your inbox is the reset route into most of your other accounts, a stolen credential that cannot open your mailbox cannot ride it into those accounts either.

The second half is the phishing wave. Mail from a sender you have not approved goes to Trash rather than your Inbox, and Trash auto-deletes after 30 days. The fake d POINT Club notice lands there instead of in front of you. If a message in Trash is one that many other OptMsg users have opted in to, you get a push alert about it, so a real notice does not sit there unseen.

What this does not cover is worth saying out loud. A compromised device, a live phishing page you type your details into, or an attacker holding your unlocked phone are all outside the argument. The claim is about stolen passwords being useless against your inbox, and about unapproved mail going to Trash.

If your address is sitting on a list like this one, you can start a new inbox that works on approval instead of cleanup.

Create Your Account

Frequently asked questions

Was I affected by the Sony data breach? The exposed records belong to customers of So-net and the plala S Course service, both Japanese internet services. NTT Docomo says every current Hikari customer is affected, along with anyone who canceled within the previous six months. The announcement does not name PlayStation or Sony Entertainment accounts.

How many records were exposed? Sony’s investigation confirmed 2,585,481 customer records: 2,141,986 from So-net and 443,495 from plala S Course. A separate group of 54,401 email addresses also lost its account passwords.

Were passwords stolen? Not in the main file of 2,585,481 records, which Sony describes as names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs. The separate group of 54,401 mail accounts did lose its passwords.

Was financial information taken? Sony says the 2,585,481 records held no banking details, payment card numbers and no other account details.

What should I watch for after this breach? NTT Docomo has warned customers about phishing emails and fake sites impersonating d POINT Club and a Universal Studios Japan campaign. Expect messages that quote your real name and date of birth, because both were in the stolen file.

Sources

BleepingComputer, “Sony ISP subsidiary data breach exposes 2.5 million customer records,” October 28, 2026 — https://www.bleepingcomputer.com/news/security/sony-isp-subsidiary-data-breach-exposes-25-million-customer-records/
Sony Network Communications announcement (PDF), October 27, 2026 — https://www.sonynetwork.co.jp/corporation/release/2026/v5e5u00000000zwj-att/20261027.pdf
NTT Docomo customer notice, October 27, 2026 — http://www.docomo.ne.jp/info/notice/page/261027_05_m.html
NTT Docomo phishing warning, October 27, 2026 — http://www.docomo.ne.jp/info/notice/page/261027_00.html