A password reset can close one route into an account. It cannot take back the personal details that make a scam convincing.
Sony Network Communications, Sony’s Japanese internet-service subsidiary, disclosed on Oct. 27 a breach involving 2,585,481 So-net and plala (S Course) customer records. The incident also exposed passwords for 54,401 email addresses across selected So-net email services, creating risks that extend beyond the original database.
For affected customers, the concern is both account security and what comes next: messages or calls that use genuine personal details to impersonate their internet provider.
What the So-net breach exposed
Sony’s official breach notice, published Oct. 27 and updated Oct. 29, lists 2,141,986 So-net customer records and 443,495 plala (S Course) records. The exposed fields include names, phone numbers, email addresses, user IDs, birth dates, gender, and internet connection IDs.
The two main customer-record categories did not include passwords. However, Sony identified separate exposures of email passwords and a small number of My Page login credentials. Email addresses and email-service passwords were exposed for 54,401 addresses associated with Mail Service (G), A-Box, So-net VAIO Mail, and PostPet Mail Account Service. Sony said it had not confirmed password exposure for its free basic So-net mailbox service.
Sony’s customer FAQ also confirms that seven records from notifications issued for password resets contained ‘So-net My Page user IDs and passwords’. The company said it reset those affected passwords. This exposure was separate from the 54,401 email addresses with exposed email-service passwords.
Another 16 records contained bank-account information, including account numbers and account-holder names. Sony said it does not hold bank-account PINs, and no credit-card information was included in the exposed data.
NTT Docomo’s separate notice says its affected customers used Docomo Hikari’s plala (S Course), including customers who canceled within the preceding six months. Docomo said that group’s exposed information did not include passwords or payment details; other plala services were not affected.
Detection came four days after the intrusion
Sony says unauthorized access occurred Oct. 19 and was detected Oct. 23. It then stopped the affected server and blocked communications from the unauthorized source. Investigators confirmed the personal-data exposure Oct. 24.
The company reset the affected email-service passwords Oct. 27 and reported the incident to Japan’s Personal Information Protection Commission. Its investigation into the cause and scope remains underway. In its customer FAQ, Sony said it had not confirmed secondary harm connected to the incident as of Oct. 29.
That statement leaves an important distinction: a lack of confirmed misuse does not establish that exposed credentials were never used.
“Sony says it reset the affected email passwords, which is an important step. But a password reset isn't a time machine,” said Darin Fredde, senior director at Ridge Security. “It doesn't tell us whether an inbox was accessed beforehand, and you can't exactly rotate someone's birthday.”
Why the next contact may sound legitimate
A caller who knows a customer’s name, birth date, and internet connection ID may sound like a provider’s support representative. Those details should no longer be treated as evidence that the caller is trustworthy.
Waseem Ahmed, head of engineering at Secure.com, warned that attackers could exploit the breach response itself.
“Customers should expect texts and emails posing as So-net or plala, many asking them to reset the password Sony just reset,” Ahmed said.
That is a warning about potential follow-on scams, rather than confirmation that such a campaign has occurred. Customers should reach account settings through the provider’s official website instead of following an unsolicited reset link. Recognizing the different forms of phishing, including text-message and phone scams, can also help them identify suspicious follow-up contact.
Exposed passwords also create a separate credential-stuffing risk: attackers may test the same credentials against other services where customers reused them.
“Anyone whose email password was exposed should change it everywhere they reused it, and organisations should enforce MFA and check new logins against known breached credentials,” Ahmed said.
Protect the accounts those details could unlock
Customers notified of exposed email passwords should prioritize securing the affected mailbox and any account that reused its password. Those notified of the seven exposed My Page credential records should also follow Sony’s account-reset instructions and change any reused password elsewhere.
Where the service provides the controls, review recent sign-ins, recovery details, active sessions, and forwarding rules, and enable multifactor authentication. An unfamiliar recovery address or forwarding rule warrants investigation even after a password change.
“Exposed email credentials create a dangerous ripple effect because a compromised inbox allows attackers to hijack linked services via automated password resets,” said Andrew Hartnett, CTO at Bitwarden. “Organizations need to limit this blast radius by replacing reusable credentials with phishing-resistant authentication, such as passkeys.”
Hartnett also emphasized the importance of protecting recovery methods: “However, as organizations adopt passkeys, it is just as critical to secure account recovery flows. This ensures legacy password-reset fallbacks don't inadvertently bypass these stronger cryptographic controls.”
For security teams, the incident raises a wider question: could information stolen from a consumer service help someone persuade a help desk to reset a workplace account? The risks illustrated by Microsoft 365 passkey-themed phishing show why enrollment, recovery, and support verification deserve attention alongside the login itself. Staff should verify sensitive requests through an established channel and avoid relying on personal details that may already be public.
The breach also included former customers. That makes retention a concrete security issue, although the disclosure alone does not establish that Sony retained information improperly. Teams should identify which canceled-account records they keep, document why they still need them, and remove unnecessary copies. The exposure of customer information held by shipping provider ShipMonk offers another reason to extend those checks to service providers.
Ahmed also recommended monitoring the database itself and alerting on unusual bulk reads and exports. That is a defensive recommendation, not an established finding about how this intrusion worked.
The practical goal is to address both immediate access and future impersonation. Resetting credentials reduces the value of stolen passwords; reviewing mailbox activity can uncover persistence; stronger recovery checks reduce what stolen identity details can unlock. Customers and organizations need all three because names, birth dates, and account identifiers can remain useful to criminals long after the original server has been contained.
Read more: See how a Brevo breach enabled phishing emails to 347,000 Trezor subscribers, and why familiar delivery channels can make fraudulent security alerts harder to spot.