Data Leak Hits Over 2.5 Million So-net Users in Japan

Sony Group's internet service provider, So-net, has confirmed a significant data breach affecting more than 2.58 million members, after unauthorized access was detected on a contracted system.

According to the company, the unauthorized access occurred through a third-party contractor responsible for handling certain operations on So-net's behalf, though the company has not disclosed the exact method used by the attackers.

Among the affected users, approximately 440,000 belong to "Docomo Hikari," an internet connectivity service that operates through So-net's "plala" platform, specifically its "S course" subscription plan.

So-net has issued a public advisory, urging both current and former members to remain vigilant against suspicious communications, including unexpected phone calls, emails, or text messages that may attempt to exploit the leaked data.

Such warnings are standard practice following breaches of this scale, as leaked personal details are sometimes used in phishing schemes, where criminals impersonate legitimate organizations to extract further sensitive information or payments from victims.

The company has not yet specified precisely what categories of information were compromised, though it is actively investigating the scope of the incident. It remains unclear whether financial details, such as payment information, were included among the exposed data.

This breach is likely to intensify scrutiny of cybersecurity practices among Japan's major telecommunications and internet service providers, particularly regarding the vetting and oversight of third-party contractors who manage sensitive user data.

So-net has pledged to provide further updates as its investigation progresses and has encouraged affected members to monitor their accounts closely for any signs of misuse. The company has not announced compensation measures at this stage, though such steps are common in similar cases involving large-scale data exposure.

The incident underscores ongoing challenges facing companies that rely on external vendors for data processing, as breaches originating from contractors can expose vulnerabilities that extend well beyond a company's own internal systems.