So-net resets 54,401 email passwords after database breach
News
Published 27 Oct 2026
Updated 27 Oct 2026
7 min read
Summarize with
October 27, 2026. Sony Network Communications has reset passwords for 54,401 email addresses after unauthorized access to the So-net member database exposed credentials for four mail services. Affected customers need to set new passwords through official MyPage and update the credentials saved in their mail clients.
Sony's original October 27 notice identifies the affected services and separates their exposed mail passwords from a larger disclosure of member-profile information. Sony said no secondary harm attributable to the incident had been confirmed as of October 27. The cause remained under investigation.
Which mail services are affected
The password reset covers Mail service (G), A-Box additional mailboxes, VAIO Mail, and PostPet mail accounts. It does not cover every So-net mailbox. I would check the exact service attached to an address before deciding whether this reset applies.
For Mail service (G), the notice identifies addresses on subdomains of gyao.ne.jp, gate01.com, pbc.ne.jp, and highway.ne.jp. Mail service (G) is the specific service name in Sony's disclosure.
|
|
|---|---|
Mail service (G) | 24,655 |
A-Box additional mailboxes | 17,672 |
VAIO Mail | 7,005 |
PostPet mail accounts | 5,069 |
Total | 54,401 |
The original notice lists exposed email addresses and email-address passwords for these four services.
The total is 54,401 address/password pairs. It is not a count of confirmed account takeovers or uniquely identified people. A person or organization with multiple affected mailboxes must check each address; the published figures do not establish how many distinct customers are involved.
The access, discovery, and reset timeline
Sony dates the unauthorized access to October 19. It recognized the incident on October 23, stopped the affected server, and blocked the access source. The company identified the leaked information categories and counts on October 24.
On October 27, Sony initialized the affected mail passwords and asked customers to reset them through official MyPage. That action explains why affected users need new credentials before restoring access in their mail software.
|
|
|---|---|
October 19 | Unauthorized access |
October 23 | Detection and containment |
October 24 | Leakage scope identified |
October 27 | Mail passwords initialized |
Timeline reported in Sony's original October 27 disclosure.
The notice attributes the incident to unauthorized third-party access. It does not establish a specific vulnerability, identify an attacker, or describe the password storage format. A reset is a protective response to exposed credentials, not evidence that every affected mailbox was accessed.
Member-profile records are a separate disclosure
Sony also disclosed exposure of member-profile records for So-net and plala (S-course). Those categories include names and contact information, user IDs, and internet-connection IDs. Their counts describe a different information category than the four mail-service password totals.
The original notice says passwords were not leaked for these member-profile categories. That statement must be read alongside the separate disclosure that email-address passwords were exposed for the four named mail services.
So-net member profiles
2,141,986 records. Member-profile information was exposed; Sony reported no password leakage for this category.
plala (S-course) member profiles
443,495 records. Member-profile information was exposed; Sony reported no password leakage for this category.
I would keep these record counts separate in an incident register. Adding them to the mailbox total would not produce a reliable count of unique victims. Nor does the member-profile password statement cancel the need to reset an affected mail-service password.
What affected customers should do now
Start with official account records to identify the service and address. An organization or MSP assisting customers should record which mailboxes need attention and who is authorized to change each password.
Sony warned customers about suspicious emails, SMS messages, and phone calls. A message that knows a customer's name or service details is not sufficient proof that a password-reset request is genuine. Navigate independently to the official account service.
- Confirm the service. Match each mailbox against the four named services using official account information. Do not assume every So-net address is affected.
- Open MyPage safely. Use a trusted bookmark or type the official account URL. Avoid reset links in unsolicited messages, even when the message refers to this incident.
- Set a unique password. Complete the affected mail-password reset through official MyPage. Keep the mail-service credential distinct from passwords used elsewhere.
- Update authorized clients. Replace the saved password in mail clients and other authorized mail integrations using that mailbox, then check sending and receiving.
- Review available activity. Inspect available mailbox activity, sent mail, and forwarding settings for unfamiliar changes. Treat suspicious findings as matters to investigate, not automatic proof of this incident's impact.
- Replace reused secrets. Change the password on other accounts where the exposed secret was reused. Prioritize accounts that provide access to sensitive information or account recovery.
For shared business mailboxes, coordinate the update across authorized users and integrations. Record completion without putting passwords in a support ticket. If access still fails, check that every relevant client has received the new credential before treating the problem as a separate service incident.
A desktop email application can store incoming-mail and outgoing-mail passwords separately. Check both settings when applicable, along with phones and authorized applications using the affected address. Restoring incoming mail alone is not a complete check when the mailbox is also used to send business correspondence.
Where activity is available, preserve the date and details of anything unfamiliar before changing settings. Compare unexpected activity with authorized users' actions and raise unresolved concerns through the provider's official support channel.
Why SPF, DKIM, and DMARC do not replace recovery
Legitimate mail credentials can let an attacker act through authorized infrastructure if the service accepts those credentials. A message sent that way can pass email authentication checks. Passing authentication does not establish that the person using the mailbox was authorized.
SPF evaluates sending authorization, DKIM verifies a domain signature, and DMARC evaluates authentication against the visible From domain. These controls do not reset exposed passwords or establish whether a mailbox was accessed.
Keep the incident findings separate
Sony's October 27 notice does not confirm outbound spam, inbox theft, or an incident-related deliverability outage. It does not establish blocklist (blacklist) listings, stolen DKIM keys, or SPF or DMARC failures.
Keep current DNS authentication healthy while completing credential recovery. Credential recovery is the immediate action for an affected mailbox; routine domain checks address a different part of email security. For domains an organization controls, Suped's domain health checker can check published authentication records as a separate maintenance task.
After updating the mailbox credentials, send a non-sensitive test message. Suped's email tester can inspect authentication and other delivery-related checks on that message. Its results do not prove that an account is free of unauthorized access or that historical misuse did not occur.
What administrators and MSPs should verify
For administrators, recovery means confirming that each affected mailbox has a new password and that authorized clients work afterward. Keep any observed suspicious activity separate from the exposure figures Sony published.
An MSP should verify completion per mailbox instead of marking an entire client organization recovered after one password change. A-Box customers, for example, need to account for affected additional mailboxes separately.
For organizations also operating their own sending domains, our DMARC monitoring in Suped provides a separate workflow: review sending sources, inspect reported authentication failures, and investigate unexpected changes. That workflow applies to domains under the organization's control.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
DMARC aggregate reports are not mailbox login logs. They do not provide a complete history of inbox access, sent messages, or forwarding changes. A clean report therefore cannot close a credential-exposure investigation.
Customers using provider-managed mail domains should follow Sony's account-recovery instructions. They should not edit unrelated DNS records in an attempt to repair a mailbox password problem.
Complete recovery through the official account channel
My priority for an affected mailbox is a unique replacement password, updated authorized clients, and a review of available activity. Suspicious reset messages should be handled through an independently opened official account channel.
As of October 27, Sony said no secondary harm attributable to the incident had been confirmed. An unfamiliar message or forwarding change deserves investigation without presenting it as an established consequence of this breach.
Frequently asked questions
No. The original notice identifies Mail service (G), A-Box additional mailboxes, VAIO Mail, and PostPet mail accounts. Check the service associated with the address in official account records.
The figure counts exposed email address/password pairs across four mail services. It is not a count of uniquely identified people or confirmed account takeovers.
Sony said passwords were not leaked for the So-net and plala (S-course) member-profile categories. It separately disclosed exposed mail-service passwords, so an affected mailbox still requires recovery.
The client can retain the previous credential. After setting the affected mail password through official MyPage, update the saved credential in authorized clients and integrations, then test sending and receiving.
No. Mail sent through authorized infrastructure using exposed credentials can pass authentication. DMARC does not replace a password reset or a review of available account activity.
