A 2.1 million record breach, hiding in plain sight
Sony Network Communications, which operates Japan's So-net internet service, disclosed this week that attackers exfiltrated 2,141,986 records covering current and former customers. Sony's own framing put the headline number at roughly 2.5 million affected ISP customers and former users once overlapping product lines and historical sub-brands are counted together. About 1.8 million of the confirmed records belong to current members, with more than 440,000 tied to a sub-brand called plala that also touches NTT Docomo's customer base, which is why Docomo issued its own warning about suspicious communications alongside Sony's notice.
The intrusion happened on October 19 and Sony says it was discovered October 23, a four-day window between compromise and detection that counts as reasonably fast by industry norms, especially compared with the ten-plus week detection gaps common in similar incidents elsewhere this year. The company has not attributed the attack to a named group, no data has surfaced on dark web marketplaces, and there is no visible extortion attempt against Sony or its customers. That makes this a cleaner forensic story than most breaches this size, which is exactly why the data exposed inside it is worth a closer look rather than a quick dismissal.
The data wasn't just names, it was bank accounts and passwords
For current members, the exposed fields are the standard set: names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection identifiers used for account authentication. Sony says passwords for this group specifically were not compromised, which is the one piece of good news in the disclosure. But a second tier of exposure is worse. The breach hit email service accounts across four legacy products: Email Service (G) with 24,655 accounts, A-Box with 17,672, So-net VAIO Mail with 7,005, and PostPet Mail Account Service with 5,069, and for every one of these, actual plaintext-equivalent email passwords were exposed alongside the account data.
Separately, 16 customers had full bank account details exposed, including institution name, branch, account type, account number, and account holder name, though Sony says it does not store bank PINs or anything resembling full card data. Sixteen is a small number in absolute terms, but it confirms that a consumer ISP's active customer database was still holding live banking information tied to billing relationships that, based on the products involved, may be well over a decade old. That is the detail that should concern any CTO running a subscription business with legacy billing integrations still quietly wired into a production customer database.
The exposure lived in products Sony stopped actively selling
PostPet Mail, VAIO Mail, A-Box: none of these are current Sony products in any meaningful sense. PostPet is a novelty email service built around an animated pet mascot that peaked in relevance well over a decade ago. VAIO Mail is tied to a consumer laptop line Sony sold off entirely back in 2014, meaning the hardware brand has been out of Sony's hands for twelve years while the associated mailboxes kept running underneath it. These services stayed online as a quiet customer retention courtesy, with live credentials and billing data fully intact, because migrating or sunsetting them cleanly was never prioritized against louder, more visible roadmap items competing for the same engineering time.
This is the part of the story every enterprise running on more than one generation of product should sit with carefully. A dormant service with declining usage does not stop being a data liability just because engineering attention has moved elsewhere for years. If anything, it becomes a more attractive target over time, because it typically accumulates less monitoring, slower patching cadence, and fewer security reviews than whatever the current flagship platform is running, even as the underlying data sitting inside it stays just as sensitive as the day it was collected.
Japan's ISPs are having a hard autumn, but this one stands alone
This disclosure lands in the same week Japan's GMO Internet confirmed hackers posted stolen customer data from a separate incident, part of a broader wave of attacks hitting the country's telecom and financial sector in recent weeks. It is tempting to read the two as connected, and several outlets have grouped them together in coverage, but they involve different companies, different systems, and no established technical link between the attacks. Treating every breach in a regional cluster as one unified story is a common analytical mistake, and it obscures the fact that each incident has its own specific governance failure underneath it worth learning from on its own terms.
In Sony's case, the specific failure is legacy product data retention, not a shared platform vulnerability with GMO or any other Japanese ISP caught up in the same news cycle. That distinction matters for how a reader prioritizes the fix at their own company. A sector-wide threat calls for threat intelligence sharing and coordinated sector defense. A legacy-system data retention failure calls for an internal audit of every product your company has ever shipped and quietly stopped promoting, because the next breach disclosure carrying your company's name is statistically more likely to trace back to the old, forgotten product than to the new one everyone is watching closely.
The roadmap implication: audit by product age, not just by current risk
Most data governance reviews are organized around current business criticality: what holds the most customers, the most revenue, the most regulatory exposure today. That framing would have missed PostPet and VAIO Mail at Sony entirely, because by current-criticality standards those products rank near zero on anyone's dashboard. A better audit axis is product age combined with data sensitivity regardless of current usage volume, which would have flagged exactly the four legacy mail services that ended up exposed, long before an attacker found them first.
If your company has shipped more than one generation of product, whether through organic evolution or acquisition, pull the full list of systems still holding live customer credentials or payment data, sorted by last meaningful product investment rather than by current traffic or revenue. Anything that shows heavy data sensitivity paired with low recent investment is your highest-probability next breach, and it is a meaningfully cheaper fix now, framed as a retention and decommissioning project with a budget line, than it will be later, framed as a disclosure with a regulator and a law firm attached.
