ENKR

So-net member database breach, So-net and plala (S course) members

Add to my breach check

Made public · 2,585,481 member records

What leaked9

Replaceable

  • Plain-text password

Hard to replace

  • Bank account number
  • Mobile number
  • Email address
  • Other profile data
  • Username

Permanent

  • Date of birth
  • Full name
  • Gender
  • Plain-text passwordmail passwords of 54,401 So-net addresses on four mail services (Mail Service · G, A-Box, Sonet VAIO Mail, PostPet mail account service), which let a third party read and send mail; for 7 members also the My Page password from a password-reset notice; So-net reset them
  • Bank account numberbank account details of 16 So-net members · bank, branch, account type, number, holder name; So-net does not hold the PIN
  • Mobile numberphone number · type not stated
  • Other profile datainternet connection ID
  • Usernameuser ID for the So-net My Page

To-dos5 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover, SMS code theft
  4. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover

What happened next13 events

  1. Undetected 2 events4 days · show events
  2. Response 11 eventsNotice in 6 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Letters sent to the customers whose bank account details (16) or password-reset notices (7) leaked, after a My Page notice or email
  2. NTT Docomo opened a dedicated phone line for plala (S course) customers
  3. NTT Docomo, which contracts the plala (S course) service to Sony Network Communications, announced that data of 443,495 current plala (S course) customers and those who cancelled in the past six months leaked; it was told on 26 October
  4. No secondary harm from the breach known as of 27 October; customers warned about suspicious contacts that use the leaked data
  5. Opened a Q&A page and a dedicated So-net phone line
8 more
  1. By 27 October, reported to the Personal Information Protection Commission
  2. Reset the leaked mail passwords of four mail services from about 10:00 JST; users must set a new password to use their mail again
  3. Apologised in its notice
  4. Notice: 2,141,986 So-net and 443,495 plala (S course) member records, 54,401 mail addresses with their mail passwords and 16 bank account records leaked
  5. Investigation found that personal data had leaked and established the items and counts
  6. Stopped the server and cut off traffic from the source of the access
  7. Confirmed the unauthorised access to the So-net member database made on 19 October
  8. Intrusion began
Company
So-net
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
2,585,481 member records: 2,141,986 So-net (1,869,771 current members, 272,215 who left from March 2026 on) and 443,495 plala (S course) · company notices

Sources