On April 26th, Sony's PlayStation Blog gave further details as to the nature of the outage and admits that PlayStation Network User's personal information has been compromised. In an email going out to users of the service:
"We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network. In response to this intrusion, we have:
1. Temporarily turned off PlayStation Network and Qriocity services;
2. Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and
3. Quickly taken steps to enhance security and strengthen our network infrastructure by re-building our system to provide you with greater protection of your personal information.
We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.
Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.
For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well."
In a follow up to the news, the online “hacktivist” group Anonymous is calling out to users of the PlayStation network to file a class action lawsuit for the potential damages that could be incurred as a result of this data breach. In an article posted by Anonymous on chronicle.su:
“Sony’s incompetence has led to the personal loss of privacy for all of its users. It is safe to assume that this will most likely lead to financial losses in a significant proportion of Sony customers. This applies even if the credit card information is proven safe. Phishers will have no problem scamming big money out of Sony’s mistake. Representatives of the 69 million Playstation Network users are to file a class-action suit shortly. Sony will pay for the damages they have incurred. The masses will not be satisfied with small PSN trifles in exchange for network downtime. This is far beyond the scope of network downtime.”
The fact that Sony has known of an actual data breach since the 19th is an alarming one. Having not given its users notice that their personal data including credit cards may have been compromised as soon as they found the breach has given the intruders a six day lead on using that personal information for their own benefit. Millions of consumers have entrusted their personal and confidential information to Sony. Sony has acted irresponsibly in not notifying the public of the breach in a timelier manner. While the shutdown of the Qriocity and PlayStation Network services may have mitigated the risk of further data theft, it did nothing to protect its users, nor give its users sufficient notice to be able to cancel credit cards or put purchase monitors on them, change passwords on other services and email accounts, or any other necessary measures that are now needed to protect themselves.
The manner in which Sony has handled this breach has been at the very least atrocious as far as its user population is concerned. Companies that warehouse personal and confidential digital information should be held to a higher standard in regards to the public disclosure of potential breaches of personal information. And while I agree with Anonymous’ call for a class action lawsuit, I do not believe that Sony will learn its lesson from this from something that can be settled quietly behind closed doors. Perhaps it’s time for Mr. Hirai to soak up some of the limelight in front of a Senate Judiciary Committee.
Read more about the events as they unfolded from our Editors Matt Torino and Patrick Nosker.
