Ma’lumotlar sizib chiqishi
Xakerlar Sony’ning yapon ISP So-net’idan 2,6 million yozuvni o‘g‘irladi
Yaponiyada So-net va Plala mijozlarining ma’lumotlari ochiq qoldi, shuningdek 54 401 elektron pochta hisobining parollari va 16 bank hisob yozuvi ham.
Muallif
Eduard Kovacs
| 2026-yil 29-oktabr (ET 7:00)
Xakerlar Yaponiyada hozirgi va sobiq So-net va Plala internet obunachilarining shaxsiy ma’lumotlarini o‘g‘irladi, deb Sony Network Communications 27-oktabrda e’lon qildi. Taxminan 2,6 million yozuv ta’sirlandi.
Hujumchilar 19-oktabrda So-net a’zolar ma’lumotlar bazasiga kirib olishdi. Kompaniya birinchi marta 23-oktabrda hujumni aniqladi, so‘ngra maqsadli serverni o‘chirib, hujumchilardan kelayotgan trafikni to‘xtatdi.
Keyingi kunga kelib, tergovchilar shaxsiy ma’lumotlar o‘g‘irlanganini tasdiqladilar va sizib chiqish ko‘lamini aniqladilar.
O‘g‘irlangan ma’lumotlar orasida ismlar, tug‘ilgan sanalar, jins, telefon raqamlari, elektron pochta manzillari, foydalanuvchi ID’lari va mijozlar internetga ulanish uchun ishlatadigan ID’lar bor.
Taxminan 2,6 million ochiq qolgan yozuvdan 2,14 millioni So-net obunachilariga, 443 000 tasi esa Plala (S Course) obunachilariga tegishli. Ularning taxminan 293 000 tasi 2026-yil mart oyida yoki undan keyin xizmatdan chiqqan odamlarga tegishli, chunki ularning ma’lumotlari yakuniy hisob-kitoblar va qo‘llab-quvvatlash so‘rovlarini hal qilish uchun bir muddat saqlanadi.
Xakerlar shuningdek to‘rtta qo‘shimcha pochta xizmatiga tegishli taxminan 54 000 elektron pochta manzili va ularning parollarini ham qo‘lga kiritdi: Mail Service (G), A-Box, So-net VAIO Mail va PostPet elektron pochta hisob xizmati. So-net obuna bilan birga keladigan bepul asosiy pochta qutisi uchun hech qanday parol sizib chiqishi aniqlanmagan.
Reklama. O‘qishni davom ettirish uchun pastga aylantiring.
27-oktabrda kompaniya ta’sirlangan elektron pochta manzillari parollarini qayta o‘rnatishni boshladi va foydalanuvchilardan xizmatlardan foydalanishni davom ettirishdan oldin yangi parollarni belgilashni talab qildi.
“So-net Webmail va elektron pochta dasturlari orqali elektron pochta manzillari va ularning parollarining sizib chiqishi tufayli, ma’lumotni qo‘lga kiritgan uchinchi tomon mijozlarning elektron pochta manzillaridan foydalanib, elektron xatlarni ko‘rish, yuborish va qabul qilish imkoniyatiga ega bo‘ldi. Biz mijozlar elektron pochta manzillarining ruxsatsiz ishlatilishini oldini olish uchun shoshilinch chora sifatida ushbu choralarni joriy etdik,” — deb yozilgan So-net tomonidan e’lon qilingan savol-javob tarjimasida.
Sizib chiqish shuningdek bank hisob tafsilotlarini o‘z ichiga olgan 16 yozuvga ham ta’sir qildi, jumladan bank va filial, hisob turi, hisob raqami va hisob egasining ismi. So-net bu hisoblar uchun PIN-kodlarni saqlamasligini aytadi.
Kredit karta ma’lumotlari bu hodisaga aloqador emas, chunki So-net ularni saqlamaydi. NURO va kompaniyaning boshqa takliflari ham ta’sirlanmaganga o‘xshaydi.
Hujumchilar qanday kirib olgani oshkor qilinmagan. So-net sababni uchinchi tomonning ruxsatsiz kirishi deb ko‘rsatadi va hali ham tergov o‘tkazilayotganini aytadi. Hodisa Yaponiyaning Shaxsiy ma’lumotlarni himoya qilish komissiyasiga xabar qilingan.
Bog‘liq: Xakerlar Nikkei’dan 1,8 million yozuvni o‘g‘irladi
Bog‘liq: Yaponiyaning Raqamli agentligida 240 000 kishi ma’lumotlar sizib chiqishidan ta’sirlandi
Bog‘liq: Kiberhujum Yaponiyaning muzlatilgan oziq-ovqat giganti Nichirei faoliyatini buzdi
Yozgan muallif: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek’ning katta boshqaruvchi muharriri. U jurnalistika sohasida ish boshlashdan oldin o‘rta maktabda IT o‘qituvchisi bo‘lib ishlagan. Eduard sanoat informatikasi bo‘yicha bakalavr darajasiga va elektr muhandisligida kompyuter texnikasi bo‘yicha magistr darajasiga ega.
Kundalik xabarnoma
So‘nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlaridan xabardor bo‘lish uchun SecurityWeek elektron pochta xabarnomasiga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Ko‘proq ma’lumot olish uchun Maxfiylik siyosatimizni o‘qing.
Eduard Kovacsdan ko‘proq
- EPICS tadqiqot muassasasi nazorat dasturida uzoq yashiringan kamchiliklar tuzatildi
- CISA Node2Shell ekspluatatsiyasi haqida ogohlantiradi, chunki Honeypotlar hujum urinishlarini qayd etmoqda
- Tailscale “Tailworm” kamchiliklarining muvofiqlashtirilmagan oshkor qilinishidan so‘ng shoshilinch tuzatishlarni chiqaradi
- iOS, macOS 27.2 286 xatoni tuzatadi; ekspluatatsiya qilingan kamchilik iOS 18’ga orqaga qaytarildi
- Dengiz koalitsiyasi kema va port tizimlari uchun bepul zaiflik ma’lumotlar bazasini ishga tushiradi
- Sanoat sotuvchilari PHP2Shell zaifliklari uchun mahsulotlarini tekshiradi
- PHP2Shell ekspluatatsiyasi tekshiruvlardan ishlaydigan qobiqlarga o‘tadi
- Node2Shell: Brotli kamchiligi Microsoft, Node.js, Python paketlarida tuzatishlarni keltirib chiqaradi
So‘nggi yangiliklar
- Cisco SD-WAN nol kun ekspluatatsiyasi Volt Typhoon’ning “Jim poyezd” tarmog‘i bilan bog‘liq
- Hujumchilar avgustdan beri ikkinchi Cisco Firewall VPN nol kunini ekspluatatsiya qiladi
- HHS arizasi iRhythm ma’lumotlar sizib chiqishi sonini 8,2 million deb ko‘rsatadi
- Xitoy bilan bog‘liq xakerlar ESXi jurnal yozuvi kamchiligini nol kun sifatida jimgina ishlatdi
- Ukraina Hive va Nefilim ransomware sherigi AQShda 70 oy qamoqqa hukm qilindi
- Upwind Security 3,8 milliard dollar bahoda 400 million dollar yig‘di
- Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatadi
- GoAhead veb-serverida yuzlab million qurilmalarda ishlatiladigan TLS kamchiliklari topildi
Trendda
Tailscale “Tailworm” kamchiliklarining muvofiqlashtirilmagan oshkor qilinishidan so‘ng shoshilinch tuzatishlarni chiqaradi
Node2Shell: Brotli kamchiligi Microsoft, Node.js, Python paketlarida tuzatishlarni keltirib chiqaradi
Xitoy bilan bog‘liq xakerlar PHP2Shell’ni firewall’larni ildiz olish uchun ekspluatatsiya qiladi
CISA Node2Shell ekspluatatsiyasi haqida ogohlantiradi, chunki Honeypotlar hujum urinishlarini qayd etmoqda
iOS, macOS 27.2 286 xatoni tuzatadi; ekspluatatsiya qilingan kamchilik iOS 18’ga orqaga qaytarildi
HPE tarmoq mahsulotlarida o‘nlab muhim kamchiliklarni tuzatadi
Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatadi
Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlaydi
Kundalik xabarnoma
So‘nggi tahdidlar, tendensiyalar va texnologiyalar, shuningdek soha mutaxassislari fikrlaridan xabardor bo‘lish uchun SecurityWeek elektron pochta xabarnomasiga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Ko‘proq ma’lumot olish uchun Maxfiylik siyosatimizni o‘qing.
Vebinar: Agentik pentestlash kuchliroq CTEM dasturi uchun
2026-yil 4-noyabr
Pentestlar orasidagi xavfsizlik bo‘shliqlarini yoping. Ushbu sessiyaga qo‘shiling va agentik pentestlashni o‘rganing hamda CTEM dasturingizda uzluksiz ta’sirni tekshirish uchun amaliy asosni oling.
Ro‘yxatdan o‘ting
Virtual tadbir: CISO Forum 2026 sammiti
2026-yil 10 va 11-noyabr
CISO’lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni o‘rganish uchun birlashtiramiz.
Ro‘yxatdan o‘ting
Harakatdagi odamlar
Quantum eMotion Wayne Teepleni CTO etib tayinladi.
Guy Ellis NCC Group’ning CEO’si etib tayinlandi.
Noma Security Bobby Shokerni CFO va Alberto Rodriguesni CCO etib tayinladi.
Harakatdagi ko‘proq odamlar
Mutaxassis fikrlari
Hech kim xavfsizlik so‘rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
Deyarli har bir B2B bitimni ochadigan jarayon — yuboruvchining o‘zi ishonmaydigan va qabul qiluvchi qabul qiladigan o‘z-o‘zini baholash. Nihoyat kompaniyalar o‘rtasida ishonch uchun yaxshiroq asos bor. (Sravish Sridhar)
Bu normal: NetScaler nol kunlari bizga yangi normal haqida nima aytadi
Yaqinda Citrix NetScaler tuzatishlari chiqarilishi mumkinligi uchun tuzatish boshqaruv quvurlarini tayyor saqlang. (Tod Beardsley)
AI dasturiy ta’minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashgani xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta’sir qiladi. (Matias Madou)
Kontekst zamonaviy kiberhujumlarga qarshi kurashda qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni ulash, keyin nima kelishini oldindan bilish va tahdidlar kuchayishidan oldin ularni to‘xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o‘zgartirdi, xavfsizlik asoslarini emas
AI zaiflikni aniqlash va ekspluatatsiyani tezlashtirgan sari, virtual tuzatish hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog‘liq. (Joshua Goldfarb)
Data Breaches
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records.
By
Eduard Kovacs
| October 29, 2026 (7:00 AM ET)
*
Hackers have stolen the personal information of current and former So-net and Plala internet subscribers in Japan, Sony Network Communications announced on October 27. Nearly 2.6 million records were impacted.
The attackers broke into the So-net member database on October 19. The company first spotted the intrusion on October 23, then took the targeted server offline and cut off traffic coming from the attackers.
By the following day, its investigators had confirmed that personal data had been taken and determined the scope of the leak.
The stolen information includes names, dates of birth, gender, phone numbers, email addresses, user IDs, and the IDs customers use to connect to the internet.
Of the roughly 2.6 million exposed records, 2.14 million belong to So-net subscribers and 443,000 to Plala (S Course) subscribers. Roughly 293,000 of them relate to people who left the services in March 2026 or later, as their details are kept for some time to handle final bills and support requests.
The hackers also obtained approximately 54,000 email addresses, along with their passwords, belonging to four additional mail services: Mail Service (G), A-Box, So-net VAIO Mail, and the PostPet email account service. So-net has not identified any password leak for the free basic mailbox that comes with a subscription.
Advertisement. Scroll to continue reading.
On October 27, the company began resetting the passwords for the impacted email addresses, forcing users to set new ones before they could resume using the services.
“Due to the leak of email addresses and email address passwords, a third party who obtained the information was in a position to view, send, and receive emails using email software and So-net Webmail. We implemented these measures as an emergency step to prevent unauthorized use of customers’ email addresses,” reads a translation of an FAQ issued by So-net.
The breach also impacted 16 records containing bank account details, such as the bank and branch, account type, account number, and account holder’s name. So-net says it does not hold the PINs for these accounts.
Credit card data is not involved, because So-net does not store it. NURO and the company’s other offerings do not appear to be affected.
How the attackers got in has not been disclosed. So-net lists the cause as unauthorized access by a third party and says it is still investigating. The incident has been reported to Japan’s Personal Information Protection Commission.
Related: Hackers Steal 1.8 Million Records From Nikkei
Related:240,000 Hit by Data Breach at Japan’s Digital Agency
Related: Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software
- CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
- Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
- iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
- Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities
- PHP2Shell Exploitation Moves From Probes to Working Shells
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Latest News
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
- Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
- Upwind Security Raises$400 Million at$3.8 Billion Valuation
- Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
Trending
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
HPE Patches Dozens of Critical Flaws in Networking Products
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Hackers Start Probing Fresh Oracle EBS Vulnerability
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Quantum eMotion has named Wayne Teeple as CTO.
Guy Ellis has been appointed CEO of NCC Group.
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
More People On The Move
Expert Insights
*
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)