In one week, two of Japan's best-known consumer brands disclosed breaches. On Oct. 27, Sony Network Communications, which runs the So-net internet service, said an intruder had taken data on roughly 2.6 million current and former customers. A day later, Japan Airlines told passengers that hackers had reached part of its reservation data through Amadeus IT Group, the company that runs JAL's flight reservation, ticketing and check-in systems.

Neither incident stands alone. According to The Record, the country is also dealing with breaches at Burger King Japan and Capcom, and Prime Minister Sanae Takaichi used an Oct. 26 cabinet meeting to promise emergency measures. "We must urgently strengthen our countermeasures," she told reporters, according to the Japan Times as quoted by The Record.

The So-net intrusion: four days to notice

Sony Network Communications' Japanese-language notice gives a short timeline. The unauthorized access began on Oct. 19. The company found it on Oct. 23, when it stopped the affected servers and blocked the hostile traffic, and it confirmed a leak on Oct. 24. That means the attacker had about four days inside before anyone noticed. Sony lists the cause only as unauthorized access by a third party, still under investigation, and no group has been publicly linked to the attack.

The exposed data falls into three groups:

  • So-net members: 2,141,986 records. Of these, 1,869,771 belong to current customers and 272,215 to former customers who left since March 2026. The fields are names, phone numbers, email addresses, user IDs, birth dates, gender and internet connection IDs. The company says this table contained no passwords.
  • So-net mail accounts: email addresses with mailbox passwords. Sony lists exposed accounts across several mail products, including 24,655 free mail service addresses, 17,672 A-Box accounts, 7,005 So-net VAIO mail accounts and 5,069 PostPet accounts. Those four figures add up to 54,401 addresses, the same total BleepingComputer reports. Sony says it reset those mailbox passwords itself on Oct. 27 and that affected customers must set a new one through the So-net My Page portal.
  • plala (S Course) members: 443,495 records. These cover 422,365 current and 21,130 former subscribers. According to BleepingComputer, Sony provides the Docomo Hikari internet service for NTT Docomo under the plala brand.

BleepingComputer adds the So-net and plala totals to get 2,585,481 records. Sony says none of the exposed data included credit card information, although its notice also reports 16 bank account records (without PINs) and 7 password-reset notice records, which it is handling with individual contact. BleepingComputer reports that Sony has reported the incident to Japan's Personal Information Protection Commission (PPC), and that neither company had confirmed misuse of the data as of Oct. 27. The outlet also reports that NTT Docomo has warned customers about phishing emails pretending to come from its d POINT Club loyalty program and a Universal Studios Japan promotion. It says Docomo describes the incident as affecting all current Hikari service clients and those who cancelled within the preceding six months.

The mailbox passwords are the most dangerous part of the leak, though Sony has since reset them. Names, birth dates and phone numbers are useful for fraud. A working email password is a direct way in. Email is where password resets land, so anyone who can read an inbox can often take over the bank, shopping and social accounts tied to it.

JAL and the supply-chain problem

The JAL incident shows a different weakness. According to The Record, the breach was at an IT provider rather than JAL itself. Amadeus told the airline last week that hackers had accessed part of the reservation data for Japan Airlines and Japan Transocean Air flights. About 92,000 customers had their names, reservation codes and flight information exposed. For roughly 2,000 of them, passport numbers, frequent flyer numbers, email addresses and phone numbers were also exposed. JAL says no card numbers were involved and flight operations were unaffected.

A reservation code (the six-character booking reference, sometimes called a PNR locator) combined with a passenger's name is often enough to open a booking on an airline's website. It also makes a phishing email look real. A message that quotes your exact flight and booking code is much more convincing than a generic "verify your account" email. Passport numbers are less useful for immediate fraud, but they are permanent and hard to change. That makes them valuable for building identity profiles over time.

For enterprise security teams, the point is familiar: you can audit your own perimeter carefully and still have customer data leak through a shared platform you don't run. The Record does not say whether other carriers were affected.

A national pattern, and a political response

The Record lists 11 million people affected at Burger King Japan and 11.7 million at Capcom. BleepingComputer, writing about the So-net case, points to other Japanese incidents this year: a malware attack on GMO Internet's Onamae Desktop Cloud, a KDDI incident affecting 12 million people, and ransomware at data-center operator IDC Frontier. The sources do not link these incidents to a single actor, and ZeroDayFeed is not suggesting a link.

The pattern is now a political issue. Beyond Takaichi's promise of emergency measures, The Record reports that Japan's defense ministry said Japanese and U.S. defense chiefs discussed the attacks. Details of the emergency package have not been published.

The regulator had already raised the alarm. On Oct. 7, Japan's Personal Information Protection Commission posted an alert titled "Response in light of large-scale leak incidents," along with a revised version of its "WARNING" guidance on preventing personal-data leaks from unauthorized access. The original guidance dates from Dec. 11, 2024. An explainer video was added on Oct. 9. The revision came almost two weeks before the So-net intrusion began.

What It Means for Defenders

If you or your users have So-net or plala accounts:

  • Treat every So-net mail password covered by the notice (free mail, A-Box, So-net VAIO mail, PostPet) as compromised. Sony has already reset these passwords, so set a new one through the So-net My Page portal. Then change the password on any other service where the same password was used. Attackers routinely try leaked email and password pairs against other sites, a technique called credential stuffing.
  • Check which accounts use a So-net or plala address for password resets, and turn on multi-factor authentication for those accounts wherever it is offered.
  • Expect targeted phishing. Docomo has already flagged messages impersonating d POINT Club and a Universal Studios Japan campaign. Messages that quote your name, birth date, user ID or connection ID should get more suspicion, not less, because that data is now in attackers' hands.
  • The leaked member table had no passwords, according to Sony. But birth dates and phone numbers are common security-question answers and SIM-swap starting points. Ask your mobile carrier about account PINs or port-out protection.

If you flew JAL or Japan Transocean Air:

  • Be wary of any email, SMS or call that quotes your booking reference or itinerary and asks you to "reconfirm" payment or personal details. Go directly to the airline's site or app instead of following links.
  • If you are among the roughly 2,000 travelers whose passport and frequent flyer numbers were exposed, watch your loyalty account for unexpected redemptions and set or change its password and PIN.

For organizations, including those working toward CMMC:

  • Measure your dwell time honestly. Sony needed four days to spot an intrusion into a multi-million-record database. Check whether your logging and alerting would flag bulk reads of customer tables sooner.
  • Don't keep passwords in a form that can be read back. The mailbox-password exposure is what makes this breach serious, and the bank-account records add to it. Find out how credentials for legacy services such as old webmail and bundled consumer products are stored, and retire the ones nobody owns.
  • Review data retention. More than 290,000 of the exposed records belonged to former customers. Data you no longer need still carries breach liability.
  • Map third-party exposure. The JAL case is a supplier breach. List which vendors hold your customer data, what notification timelines your contracts require, and whether you could send your own customer notice within days of a vendor alert.
  • If you operate in Japan, read the PPC's revised WARNING guidance from Oct. 7 and expect tighter scrutiny once the government's emergency package is published.

None of the sources describe a software vulnerability or patch tied to these incidents. For now, the response is credential rotation, phishing awareness and vendor risk management, not a version upgrade.

Sources