Sony Network Communications, a subsidiary of Sony Group, announced the breach on October 27. It affected 2,585,481 current and former users of its So-net and plala internet services.
An unauthorized external party accessed the company’s member database on October 19. Exposed information included names, phone numbers, email addresses and dates of birth.
The breach also exposed bank account information for 16 people and more than 54,000 email passwords. No credit card information was compromised.
Sony Network Communications took the affected servers offline and reported the incident to the Personal Information Protection Commission. The company is contacting affected users individually.