INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Sony ISP subsidiary suffers massive data breach exposing customer records

| 2026-10-28 16:45 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A Sony Group Corporation subsidiary, acting as an internet service provider (ISP) in Japan, reported a data breach that compromised approximately 2.5 million records containing current and former customers' personal information on October 19, which was detected four days later. The breach exposed customer records including full names, phone numbers, email addresses, user IDs, dates of birth, gender, internet connection IDs, but no banking or payment card details were affected. An additional 54,401 email addresses from several services and account passwords were also exposed. Sony Network Communications is investigating the cause and scope of the breach, which was reported to Japan's Personal Information Protection Commission. The incident has prompted NTT Docomo, another internet service provider that contracts Sony for its services, to warn customers about phishing emails and fake websites impersonating its campaigns, affecting all current Hikari service clients and those who canceled within six months.
Technical Mitigations AI-generated
• Patch the So-net member database and plala (S Course) records to prevent unauthorized access. • Monitor for phishing emails impersonating NTT Docomo's d POINT Club and Universal Studios Japan campaigns, which may prompt users to enter personal information. • Implement additional security measures on customer servers affected by the GMO Internet Group malware attack.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
JP
financefinance telecommunicationstelecommunications
Incident Timeline
‎early 2025
Threat actors who previously breached NTT in early 2025 gained access to its systems and stole data of 18,000 corporate customers.
organisation NTT
Previously, NTT was hit in early 2025 by hackers who gained access to its systems and stole the data of 18,000 corporate customers .
victims 18,000 corporate customers
Previously, NTT was hit in early 2025 by hackers who gained access to its systems and stole the data of 18,000 corporate customers .
‎October 19
Threat actors exploited a vulnerability to breach Sony's ISP subsidiary, resulting in the exposure of 2.5 million customer records.
‎2026/10/27
Threat actors accessed Sony's So-net member database, supporting its internet access service.
‎October 27
Threat actors used social engineering tactics to target Sony's ISP subsidiary, resulting in the exposure of 2.5 million customer records.
‎2026/10/28
Sony Network Communications, a subsidiary of Sony Group Corporation providing telecommunications and technology services as an internet service provider in Japan, confirmed a data breach exposing approximately 2.5 million customer records containing current and former customers' personal information.
organisation Sony Group Corporation
A Sony Group Corporation subsidiary, the company provides telecommunications and technology services, acting as an internet service provider (ISP) in Japan.
organisation Universal Studios Japan
NTT Docomo also notified customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan (USJ) campaign, falsely claiming that recipients had won and prompting them to enter personal information to claim tickets.
organisation USJ
NTT Docomo also notified customers about the breach and warned of phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan (USJ) campaign, falsely claiming that recipients had won and prompting them to enter personal information to claim tickets.
organisation Sony
Sony ISP subsidiary data breach exposes 2.5 million customer records.
organisation ISP
Sony ISP subsidiary data breach exposes 2.5 million customer records.
data_breach 2.5 customer records
Sony ISP subsidiary data breach exposes 2.5 million customer records.
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information.
organisation Sony Network Communications
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information.
organisation KDDI
Telecommunications giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware .
organisation Frontier
Telecommunications giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware .
victims 12 customers
Telecommunications giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware .
organisation Phone
The investigation confirmed that a total of 2,585,481 customer records had been exposed, including the following types of information: Full names Phone numbers Email addresses User IDs Dates of birth Gender Internet Connection IDs No banking, payment card, or other account details were exposed.
data_breach 2,585,481 customer records
The investigation confirmed that a total of 2,585,481 customer records had been exposed, including the following types of information: Full names Phone numbers Email addresses User IDs Dates of birth Gender Internet Connection IDs No banking, payment card, or other account details were exposed.
organisation NTT Docomo
The latter impacts another internet service provider, NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services.
organisation Docomo Hikari
The latter impacts another internet service provider, NTT Docomo, which contracts Sony Network Communications to provide its Docomo Hikari services.
organisation GMO Internet Group
One of the most recent is the incident at GMO Internet Group and its Onamae Desktop Cloud service, which suffered a widespread malware attack on customer servers .
organisation Onamae Desktop Cloud
One of the most recent is the incident at GMO Internet Group and its Onamae Desktop Cloud service, which suffered a widespread malware attack on customer servers .
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Tactical Metrics
Metrics
data_breach
2,500,000
Customer Records
Sony ISP subsidiary data breach exposes 2.5 million customer records.
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information.
Metrics
victims
12,000,000
Customers
Telecommunications giant KDDI suffered a breach affecting 12 million customers, and IDC Frontier was targeted by ransomware .
Metrics
data_breach
2,585,481
Customer Records
The investigation confirmed that a total of 2,585,481 customer records had been exposed, including the following types of information: Full names Phone numbers Email addresses User IDs Dates of birth Gender Internet Connection IDs No banking, payment card, or other account details were exposed.
Metrics
victims
18,000
Corporate Customers
Previously, NTT was hit in early 2025 by hackers who gained access to its systems and stole the data of 18,000 corporate customers .
Intelligence Sources
BleepingComputer 2026-10-28