Data breach at Sony-owned internet provider compromises 2.6 million customer records
Sony-owned ISP So-net suffers data breach, exposing 2.6 million customer records and email passwords.
Sony Network Communications disclosed a data breach at its Japanese ISP subsidiary, So-net, impacting over 2.58 million current and former customers. Attackers gained unauthorized access to the member database, stealing personal information including names, phone numbers, email addresses, dates of birth, and internet connection IDs. Additionally, email passwords for 54,401 users and 16 bank account records were compromised. The incident has been reported to Japan's Personal Information Protection Commission.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Sony?
Get an email when a new story names Sony, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers gained unauthorized access to So-net's member database, exfiltrating personal information for over 2.58 million customers, including sensitive data such as email passwords and bank account details. The breach highlights critical failures in protecting stored credentials — email passwords should never be stored in a recoverable form, and sensitive financial data requires additional layers of access control and encryption. The exposure of bank account records alongside personal identifiers significantly elevates the risk of identity theft and financial fraud for affected customers. Regulatory reporting to Japan's Personal Information Protection Commission confirms the incident crosses legal thresholds, underscoring the real-world compliance and reputational consequences of inadequate data protection practices.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.