After Capcom suffered a major data breach on October 22, 2026, it’s now Sony’s turn to join the tide, as a new data breach has affected 2.58 million So-net and plala users, revealing multiple pieces of sensitive information, such as names, user IDs, emails, and even bank details.
Sony Network Communication, owned by Sony Group Corporation, confirmed a data breach affecting 2,585,481 So-net and plala customer records following unauthorised access on October 19, 2026. For those unaware, So-net and plala are Japanese internet service providers offering broadband internet, email, and related connectivity services to customers in Japan.
According to Sony, the hackers leaked the following information shortly after the data breach on October 24, exposing 2,141,986 records belonging to So-net members and another 443,495 records from plala users. Investigators also identified 54,401 email address and password combinations among the exposed data:
- Names
- User IDs
- Date of birth
- Phone numbers
- Email addresses
- Other customer information
- 16 bank account records, including account numbers
The company stated its investigation found no evidence of exposed credit card numbers or expiration dates. It also clarified that customers’ bank PINs aren’t stored in its systems, so you can rest easy. In response to the incident, Sony shut down the affected servers, blocked unauthorized access, and reset passwords for the impacted email accounts on October 27.
However, Sony is still investigating the massive data breach, and it definitely sets a bad precedent in the context of PlayStation ending PS5 physical discs in 2028, despite the breach not affecting PSN accounts.
Still, if you want to be absolutely sure, you can reset your PlayStation Network account password, as PSN faced a security issue related to unauthorized child accounts yesterday, October 26. This is an even worse look for Sony, especially with GTA 6 set to launch in just three weeks.
Sony has issued an apology to customers for the data breach and reported the same to the Personal Information Protection Commission. The company recommends not clicking on suspicious links until it gets to the bottom of the breach.
Related Articles