Sony subsidiary breach exposes 2.58 million customer records

Sony Network Communications says a breach exposed 2,585,481 customer records from its So-net and plala services. The company, a Sony Group Corporation subsidiary and an internet service provider in Japan, said an unauthorized party accessed its So-net member database.

The breach occurred on October 19 and was detected four days later. Sony Network Communications then shut down the compromised servers and blocked external communication. The exposed records include personal information belonging to current and former customers. The company said no banking, payment card or other account details were exposed.

The company’s breakdown lists 2,141,986 So-net entries and 443,495 plala (S Course) records. Separately, 54,401 email addresses from several email services were exposed along with account passwords. Sony Network Communications advised users to change their passwords.

The plala records affect NTT Docomo, which contracts Sony Network Communications for Docomo Hikari services. Docomo warned customers about phishing emails and fake websites impersonating its d POINT Club and a Universal Studios Japan campaign. The messages falsely claim recipients won and ask them to submit personal information to claim tickets. Docomo said the incident affects current Hikari clients and people who canceled within the preceding six months.

Sony reported the breach to Japan’s Personal Information Protection Commission and is investigating its cause and scope. As of October 27, neither company had confirmed misuse of the exposed data.