So-net Confirms Data Theft Affecting Nearly 2.6 Million Subscriber Records
Summary
Sony Network Communications confirmed data theft from So-net’s database, affecting nearly 2.6 million So-net and Plala subscriber records. The breach also exposed passwords for about 54,000 email accounts; So-net began resetting them.
Key points
- Attackers accessed the So-net member database on October 19; the company detected the intrusion on October 23 and took the targeted server offline.
- Investigators confirmed that personal data had been taken, affecting about 2.14 million So-net and 443,000 Plala (S Course) records.
- Exposed information included names, birth dates, gender, phone numbers, email addresses, user IDs, and internet connection IDs.
- About 54,000 email addresses and passwords from four additional mail services were obtained; So-net began resetting affected passwords on October 27.
- Sixteen records included bank account details. So-net said it does not hold those accounts’ PINs and does not store credit card data.
- The entry method has not been disclosed, and the investigation is ongoing. The incident was reported to Japan’s Personal Information Protection Commission.
Article Details
- Victim Organization
- So-net; Plala (S Course)
- Incident Type
- Unauthorized access and confirmed theft of subscriber personal information
- Data Types Exposed
- Names
- Dates of birth
- Gender
- Phone numbers
- Email addresses
- Email account passwords
- User IDs
- Internet connection IDs
- Bank account details, including bank and branch, account type, account number, and account holder's name
- Affected Records
- Nearly 2.6 million subscriber records: approximately 2.14 million So-net records and 443,000 Plala (S Course) records. Approximately 54,000 email addresses and passwords from four additional email services were also obtained; 16 records contained bank account details.
- Operational Impact
- The targeted server was taken offline and traffic from the attackers was cut off. So-net reset passwords for affected email addresses, requiring users to set new ones before using the services.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed