The facts
Sony said the intrusion occurred on 19 October, was detected on 23 October and was confirmed to involve a leak on 24 October. It stopped affected servers and blocked access. [1]
The membership records include contact details, birth dates and service identifiers. Sony also disclosed exposure of 54,401 addresses and mail passwords across four legacy or add-on email services; those passwords were reset on 27 October. [1]
Sony's notice lists 16 exposed bank-account records. It says credit-card data and main membership passwords were not exposed. Docomo separately confirmed 443,495 affected plala S Course records. [1][3]
Still unconfirmed
- The complete cause, exposure scope and subsequent misuse remain under investigation.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 07:46 UTC.
Sony's original notice lists 16 exposed bank-account records; that specific disclosure controls over BleepingComputer's broader statement that banking information was unaffected. Docomo's no-bank-data statement applies to its plala subset.
- Notice of unauthorized access and customer-information exposure
Sony Network Communications · Primary source · 27 Oct 2026
- Sony ISP subsidiary data breach exposes 2.5 million customer records
BleepingComputer · Reporting · 28 Oct 2026
- Unauthorized access affecting plala S Course customer information
NTT Docomo · Primary source · 27 Oct 2026