So-net: distinguish 2.14 million profiles and exposed email passwords

Unauthorized access on October 19, 2026; So-net press release dated October 27, updated on October 29. Sony Network Communications confirms access to a So-net member base. The title which summarizes this affair as “2.14 million stolen passwords” would be false. This figure corresponds to member records; Passwords are exposed in a separate subset of email services. This distinction changes the incident response.

Separate the affected datasets

The first set contains 2,141,986 So-net records, including 1,869,771 current members and 272,215 former members who left since March 2026. The possible fields are name, telephone, email, user ID, date of birth, gender and Internet connection ID. So-net indicates that the primary account passwords are not in this batch. Another set includes 443,495 plala records (S course) with comparable fields, without passwords.

On the other hand, So-net confirms the leak of addresses and passwords for four categories of mailboxes: 24,655, 17,672, 7,005 and 5,069 addresses respectively. These values ​​are counts per service; we cannot add them to the two masses of profiles to announce a number of unique people. So-net free primary mailbox service is not shown to be compromised. The press release also mentions 16 bank records, without PIN, and 7 password reset notifications. It excludes payment cards and other services, including NURO, from the scope observed.

Why mailboxes concentrate the risk

An address and its password potentially opens up reading messages and receiving reset links from other services. The attacker could then pivot to third-party accounts if the password remained valid, if access was not otherwise protected and if the mailbox concerned received these messages. Passwordless profiles can be used for targeted phishing, but do not prove account takeover. This difference requires two investigations: connection logs and transfer rules for exposed boxes; fraud attempts and identity correlation for profiles.

So-net says it blocked the server and the access source after detection on October 23, then established the exposed categories on the 24th. The passwords of the affected email accounts were reset on October 27; the subscribers concerned must define new ones. The precise technical cause remains “under investigation” in the press release. It would therefore be unfounded to attribute the leak to a CVE or a particular configuration defect. The case shows above all that a leak announcement must be read by table and by type of secret, not by a single eye-catching total.

Main source: So-net timeline and table, updated October 29, 2026.