Sony ISP Breach Exposes 2.6 Million Subscriber Records and Passwords
What Happened — Sony Network Communications, a subsidiary that operates the So‑net internet service, disclosed that an unauthorized third party accessed its subscriber database on 19 Oct 2026. The intrusion resulted in the exposure of 2,141,986 So‑net records and 443,495 NTT Docomo records (≈2.6 million users). Leaked fields included names, telephone numbers, email addresses, birthdates, gender, user IDs, and passwords for 54,401 email accounts. A small number of bank‑account details and password‑reset notifications were also taken. Sony reset the compromised passwords and began a broader remediation effort. The breach follows a recent wave of Japanese ISP incidents that have prompted the government to tighten breach‑reporting obligations.
Why It Matters for Trust & Control Assurance — The incident highlights gaps in authentication and privileged‑access safeguards, a core control area that underpins many regulatory frameworks.
Who Is Affected — Telecommunications/Internet Service Providers; their subscribers in Japan.
Recommended Actions
- Conduct an immediate review of database access permissions and enforce least‑privilege principles.
- Deploy multi‑factor authentication (MFA) for all privileged and administrative accounts.
- Rotate all exposed credentials and monitor for anomalous login activity.
- Update incident‑response playbooks to include evidence‑collection steps that satisfy audit‑readiness requirements.
- Document remediation steps as defensible evidence for future compliance assessments.
Technical Notes — Attack vector not publicly disclosed; attackers accessed the subscriber database without using valid customer passwords, suggesting a possible exploitation of internal credentials or mis‑configured access controls. Exposed data: personal identifiers, email addresses, birthdates, gender, user IDs, and 54 k email passwords; 16 bank‑account records and 7 password‑reset notifications. Source: DataBreachToday