Sony, So-net and Plala ISP Data Theft Exposes Customer Credentials

Key points

• Attackers took about 2.6 million customer records from three ISP-related vendors.
• More than 54,000 email passwords were exposed.
• Sixteen bank-account records were also compromised.
• No CVE was cited; the incident centers on credential and data theft.

Hackers have stolen data from ISP services associated with Sony, So-net and Plala, according to the disclosed facts. The intrusion resulted in the exposure of customer information, including email credentials and a limited number of bank-account details. The scale is substantial: approximately 2.6 million records were taken, among them 54,401 passwords and sixteen bank-account entries.

Affected parties are customers of the ISP services operated under those brands. Because email passwords were among the stolen items, the risk extends beyond the initial platforms: reused credentials can enable account takeover, phishing, and access to linked services. The bank-account exposure is small in count but high in sensitivity, so even a handful of records warrants direct notification and monitoring.

The incident matters because ISP account credentials often serve as recovery addresses and identity anchors for other online accounts. Attackers who obtain email passwords can reset passwords elsewhere, impersonate users, or pivot into business email compromise. The combination of broad customer-record theft and a narrow but serious financial-data exposure raises the stakes for both consumer and enterprise customers.

Context: no CVE was cited, which suggests the event is being treated as a data-theft and credential-exposure incident rather than a specific software vulnerability. The vendors named are Sony, So-net and Plala; the product category is ISP services. Organizations should watch for credential-stuffing attempts, phishing that references the brands, and notifications from the providers.

What to watch: confirmation of affected account ranges, password-reset guidance, and whether the sixteen bank records lead to targeted fraud attempts. IT teams should prioritize monitoring for reused credentials and unusual sign-in activity tied to these ISP domains.

What to do now

1. Immediately force resets for any corporate or user accounts that use email addresses on the affected ISP domains, and invalidate active sessions.
2. Enforce MFA on email, VPN, finance and administrative accounts; prioritize accounts with reused passwords.
3. Hunt authentication logs for credential-stuffing patterns, impossible travel, new inbox rules and unusual password-reset activity.
4. Notify affected users with clear guidance to change reused passwords and to contact their bank if they used the same credentials for financial services.
5. Scan password managers, CI/CD secrets and service accounts for credentials tied to Sony, So-net or Plala; rotate anything found.
6. Brief the help desk on phishing lures that reference these ISP brands and add detections for related domains and subject lines.
7. Review third-party ISP dependencies and remove unnecessary access to email or financial data.

Original source

SecurityWeek