The Docomo data leak exposed the personal details of 443,495 people who use, or recently used, docomo hikari’s “plala (S course)” internet service. Docomo’s own systems were not hacked. The break-in hit a server run by its contractor, Sony Network Communications, the company behind So-net. In total, about 2.58 million records leaked.
Passwords for the main accounts and credit card numbers were not taken. Names, phone numbers, birth dates and email addresses were, and that is exactly what scammers need to make a fake message look real.
Key takeaways
- On 19 October 2026, an attacker got into a So-net member database server run by Sony Network Communications.
- 2,585,481 records leaked: 2,141,986 So-net members and 443,495 docomo hikari plala (S course) users.
- Exposed: names, phone numbers, emails, user IDs, birth dates and gender. Not exposed: card data and main-account passwords.
- Separately, 54,401 email address and password pairs and 16 bank account records leaked.
- As of 27 October 2026, neither company had confirmed any misuse. Phishing is the main risk.
What happened in the Docomo data leak?
Docomo sells a fibre broadband product called docomo hikari, and customers pick an internet provider to go with it. One of those options, plala (S course), is run in the background by Sony Network Communications. Its customer records sat on the same So-net member database that got hacked.
Think of it like a building where you rent a flat through one agent, but the landlord keeps every tenant’s file in one cabinet. Someone broke into the landlord’s office, not the agent’s. You still lose your file.
Docomo said Sony Network Communications told it about the breach on 26 October 2026, and it went public on 27 October 2026, according to Keitai Watch. Docomo says customer data for its other plala services was not involved.
The timeline, day by day
The attack went unnoticed for four days, and it was eight days before the public heard about it. Here are the dates the companies have given.
| Date (2026) | What happened |
|---|---|
| 19 October | Unauthorized access to the So-net member database server |
| 23 October | Sony Network Communications detects it, shuts the server down and blocks the attacker’s traffic |
| 24 October | The company works out which data and how many records leaked |
| 26 October | Docomo is told that plala (S course) data was included |
| 27 October | Both companies announce the breach; Japan’s privacy regulator has been notified |
What data leaked, and what stayed safe?
For plala (S course) users, Docomo lists these fields: name, phone number, date of birth, gender, email address (the so-net.ne.jp address plus any contact address you registered), So-net My Page login ID and internet connection ID. Docomo says passwords, card numbers and bank account details for these users were not leaked.
The wider So-net breach goes further. Impress Watch reports that 54,401 email addresses and passwords for some mail services leaked, and those passwords have been reset. Nikkei also reported that 16 bank account records leaked. The records include current members and people who left from March 2026 onward.
- Leaked: names, phone numbers, emails, user IDs, connection IDs, birth dates, gender
- Leaked for some So-net users: 54,401 mail login pairs, 16 bank account records, 7 password reset notices
- Not leaked: credit card data, main-account passwords, data from other services such as NURO
Why should you worry if no passwords leaked?
Because the leak is ideal raw material for phishing, meaning fake messages that trick you into handing over a password or money. A scam text that knows your full name, birthday and ISP looks a lot more believable than a random “your parcel is delayed” message.
My view: the “no passwords leaked” line is technically reassuring and practically misleading. Attackers rarely need your password if they can get you to type it into their page.
What should affected users do now?
Docomo and Sony Network Communications say they will contact affected people individually. While you wait, take these steps:
- Treat unexpected contact as suspect. Don’t reply to, click links in, or open attachments from emails, SMS or calls that mention So-net, plala or Docomo.
- Go direct. Type the official site address yourself or use a number you already trust, never the one in the message.
- Change your so-net.ne.jp address if you want. You can do this in So-net My Page, though the domain part stays the same.
- Change reused passwords. If you use your So-net mail password anywhere else, change it there too.
The dedicated plala (S course) support line is 0120-035-700, open 10:00 to 19:00, including weekends and holidays. It’s an old habit worth having: we covered a similar trust problem in the Popcorn Time botnet risk, where the danger came through software people already trusted.
Why do contractor breaches keep happening?
Big brands outsource a lot: billing, support, and in this case the whole provider back end. Each contractor is another door an attacker can try. Your data is only as safe as the weakest company holding it, and most customers have no idea who that is.
This is not So-net’s first trouble either. In July 2025, the company reported that attackers using stolen IDs and passwords had changed some users’ email addresses. That was a credential attack, not a server breach, but it shows the accounts are a steady target.
What happens next
As of 27 October 2026, the cause was still under investigation, according to Business+IT. Expect three things: individual notices to affected users, a fuller account of how the attacker got in, and follow-up from Japan’s Personal Information Protection Commission, which has already been told. If the investigation finds lax security at the contractor, Docomo may face questions about how it checks the companies it hands customer data to.
Watch for waves of phishing messages. They often arrive weeks after a breach, once the headlines fade and people relax.
FAQ
Was Docomo itself hacked?
No. The attacker got into a So-net member database server run by Sony Network Communications, the contractor behind docomo hikari’s plala (S course) service.
Were credit card numbers leaked?
No. Both companies say credit card data was not leaked. A separate 16 bank account records from So-net’s wider customer base were exposed.
How do I know if I’m affected?
If you use plala (S course), or left the service from March 2026 onward, assume you might be. The companies will contact affected users directly, and you can check with the support line on 0120-035-700.
If you’re a plala or So-net user, take two minutes to change any reused passwords, then read every “Docomo” message twice before you tap.
Leave a comment