PSN still down, Sony admits it was hacked

[Phil89]

http://www.gizmodo.com.au/2011/04/sony- ... onal-data/

Sony Comes Clean: PSN Hackers Have Stolen Personal Data

By Brian Crecente on April 27, 2011 at 6:00 AM

A security breach in the PlayStation Network by still unidentified hackers resulted in stolen personal information, Sony confirmed today.

The news comes more than nine days after the intrusion and six days after Sony shut down both the PlayStation Network and Qriocity services in reaction to the breach. Sony says they’ve hired a “recognised security firm” to conduct a complete investigation into what happened and have taken steps to enhance security and strengthen network infrastructure.

“We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorised intrusion into our network,” Patrick Seybold, senior director of corporate communications for Sony Computer Entertainment of America, wrote on the official Playstation Blog today.

Among the possible information stolen:

Name
Address (city, state, zip)
Country
Email address
Birthdate
PlayStation Network/Qriocity password and login and handle/PSN online ID.

There is no evidence that credit card data was taken, Seybold writes, but they company cannot rule out that possibility.

” If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained,” he wrote.

Sony is encouraging users to be especially aware of potential phishing scams from people using email, phone calls and mail to try and extract more personal or sensitive information from you. Sony also is strongly recommending that you change you password once you’re able to log back into the Playstation Network.

“To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports,” Seybold wrote

“We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please contact us at 1-800-345-7669 should you have any additional questions.”

[[Q]]

shocking. we already knew this days ago. did you guys have your credit card info saved on your account?

[The X]

did you guys have your credit card info saved on your account?

No. I don't like paying for content that should be free so I've never added credit card info.

Although some of my friends have now cancelled their credit cards. They're COD players.

I have gone through and updated most of my passwords and tried to tighten stuff up a little.

[Andrew]

I'm sure Xbox fanboys everywhere are jeering. As for me, I'm just glad it wasn't XBL that was hacked...this time.

Sony really seems to have done gamers a disservice by dragging their feet on making the announcement, especially in light of the personal data that's confirmed to have been compromised (and potentially been compromised).

[JaoSming]

well evidently they only found out Monday

I got an email from them since my account was based in Massachusetts about all my rights and such. I can freeze my credit reports for $5 and some other legal shit. That just means these hackers have 3 year old information on me and the credit card I already closed.

[[Q]]

i'm pretty sure the card i had on there was an old one since i haven't purchased anything in a really long time, but it wouldn't hurt to continually check my statements to make sure nothing fishy goes on

[Phil89]

Just changed some passwords to be safe. I have no credit cards so no worries there.

Hope this doesn't last much longer.

[[Q]]

can you still change your password or do you need to sign in to be able to change account info?

[Andrew]

PSN Class Action Lawsuit Filed

Calling the security breach the "largest compromise of Internet security and the greatest potential for credit card fraud to ever occur in United States history," the suit accuses Sony of "breach of warranty, negligent data security, violations of consumers’ rights of privacy, failure to protect those rights, and failure and on-going refusal to timely inform consumers of unauthorized third party access to their credit card account and other nonpublic and private financial information."

According to the suit, Sony failed to maintain a proper firewall and "computer security system," "failure to properly encrypt data," "unauthorized storage and retention of data," and violation of "Payment Card Industry Data Standard(s) and rules and regulations."

Calling this a "reprehensible situation," the suit states that Sony "caused, and continues to cause, millions of consumers fear, apprehension, and damages including extra time, effort, and costs for credit monitoring, and extra time, effort, and costs associated with replacing cards and account numbers, and burden, and is harming both consumers’ and merchants’ ability to protect themselves from such fraud."

The suit categorizes the time between Sony learning of the problem and informing the public as an undue delay, saying that it prevented consumers from making informed decisions as to "whether to change credit card numbers, close the exposed accounts, check their credit reports, or take other mitigating actions."

[Phil89]

can you still change your password or do you need to sign in to be able to change account info?

I think you need to be online to do it.

[JaoSming]

evidently when it comes back we will all be forced to update our passwords

[[Q]]

can you still change your password or do you need to sign in to be able to change account info?

I think you need to be online to do it.

ok yeah that's what i thought. im guessing it might be a while before it comes back

[Phil89]

http://www.slashgear.com/psn-breach-cou ... -28149030/

PSN breach could cost Sony $24B

The Sony Playstation Network or PSN has been offline for a while now. At first users were irritated that they weren’t able to play online games and watch movies via Netflix. As the outage drug on things started to look worse with Sony hinting early on that the breach was believed to have been caused by a third party. Things deteriorated when Sony finally admitted there had been a breach, and it was possible that all the user’s account data was stolen including the credit card information.

Sony says at this point it has no indication that user credit card data was stolen. However, Application Security CTO Josh Shaul said, “They [Sony] indicated that they’re worried about it, which is probably a very strong indication that everything was stolen.” Sony has said that purchase history and credit card details “may” have been stolen but the three-digit security code wasn’t. The lack of that three digit code will do very little to protect anyone whose credit card details were stolen.

Forbes reports that if the hacker or hackers responsible for the heist were successful in getting the credit card data this would be one of the biggest known thefts of financial data. Sony is already facing class action suits over the breach, and that is only a fraction of the monetary liability Sony could have in the incident. The Ponemon Institute says that the estimated cost per record of a data breach in 2010 resulting from malicious action was $318 per compromised record. With 77 million user accounts, exposed Sony is looking at $24 billion in possible expenses.

[Lamrock]

Thank god I haven't purchased anything on PSN yet.

[koberulz]

http://www.slashgear.com/psn-breach-could-cost-sony-24b-28149030/

PSN breach could cost Sony $24B

Initially I read that from a bit too far away from the screen and thought the B was an 8.

[benji]

[shadowgrin]

For a moment there I thought that was Thug then I realized he was not talking about LeBron, so it's not Thug after all. Dude looks like Terry Crews' son, Discosean21 not Thug.



Someone should unhack the PSN.

[JaoSming]

Sony is addressing the situation in 4.5 hours.

[Phil89]

SOME PLAYSTATION®NETWORK AND QRIOCITY™ SERVICES TO BE AVAILABLE THIS WEEK

Tokyo, May 1, 2011 – Sony Computer Entertainment (SCE) and Sony Network Entertainment International (SNEI, the company) announced they will shortly begin a phased restoration by region of PlayStation®Network and Qriocity™ services, beginning with gaming, music and video services to be turned on. The company also announced both a series of immediate steps to enhance security across the network and a new customer appreciation program to thank its customers for their patience and loyalty.

Following a criminal cyber-attack on the company’s data-center located in San Diego, California, U.S.A., SNEI quickly turned off the PlayStation Network and Qriocity services, engaged multiple expert information security firms over the course of several days and conducted an extensive audit of the system. Since then, the company has implemented a variety of new security measures to provide greater protection of personal information. SNEI and its third-party experts have conducted extensive tests to verify the security strength of the PlayStation Network and Qriocity services. With these measures in place, SCE and SNEI plan to start a phased rollout by region of the services shortly. The initial phase of the rollout will include, but is not limited to, the following:

* Restoration of Online game-play across the PlayStation®3 (PS3) and PSP® (PlayStation®Portable) systems
-This includes titles requiring online verification and downloaded games
* Access to Music Unlimited powered by Qriocity for PS3/PSP for existing subscribers
* Access to account management and password reset
* Access to download un-expired Movie Rentals on PS3, PSP and MediaGo
* PlayStation®Home
* Friends List
* Chat Functionality

Working closely with several outside security firms, the company has implemented significant security measures to further detect unauthorized activity and provide consumers with greater protection of their personal information. The company is also creating the position of Chief Information Security Officer, directly reporting to Shinji Hasejima, Chief Information Officer of Sony Corporation, to add a new position of expertise in and accountability for customer data protection and supplement existing information security personnel. The new security measures implemented include, but are not limited to, the following:

* Added automated software monitoring and configuration management to help defend against new attacks
* Enhanced levels of data protection and encryption
* Enhanced ability to detect software intrusions within the network, unauthorized access and unusual activity patterns
* Implementation of additional firewalls

The company also expedited an already planned move of the system to a new data center in a different location that has been under construction and development for several months. In addition, PS3 will have a forced system software update that will require all registered PlayStation Network users to change their account passwords before being able to sign into the service. As an added layer of security, that password can only be changed on the same PS3 in which that account was activated, or through validated email confirmation, a critical step to help further protect customer data.

The company is conducting a thorough and on-going investigation and working with law enforcement to track down and prosecute those responsible for the illegal intrusion.

“This criminal act against our network had a significant impact not only on our consumers, but our entire industry. These illegal attacks obviously highlight the widespread problem with cyber-security. We take the security of our consumers’ information very seriously and are committed to helping our consumers protect their personal data. In addition, the organization has worked around the clock to bring these services back online, and are doing so only after we had verified increased levels of security across our networks,” said Kazuo Hirai, Executive Deputy President, Sony Corporation. “Our global audience of PlayStation Network and Qriocity consumers was disrupted. We have learned lessons along the way about the valued relationship with our consumers, and to that end, we will be launching a customer appreciation program for registered consumers as a way of expressing our gratitude for their loyalty during this network downtime, as we work even harder to restore and regain their trust in us and our services.”

Complimentary Offering and “Welcome Back” Appreciation Program
While there is no evidence at this time that credit card data was taken, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.

The company will also rollout the PlayStation Network and Qriocity “Welcome Back” program, to be offered worldwide, which will be tailored to specific markets to provide our consumers with a selection of service options and premium content as an expression of the company’s appreciation for their patience, support and continued loyalty.

Central components of the “Welcome Back” program will include:

* Each territory will be offering selected PlayStation entertainment content for free download. Specific details of this content will be announced in each region soon.
* All existing PlayStation Network customers will be provided with 30 days free membership in the PlayStation Plus premium service. Current members of PlayStation Plus will receive 30 days free service.
* Music Unlimited powered by Qriocity subscribers (in countries where the service is available) will receive 30 days free service.

Additional “Welcome Back” entertainment and service offerings will be rolled out over the coming weeks as the company returns the PlayStation Network and Qriocity services to the quality standard users have grown to enjoy and strive to exceed those exceptions.

SNEI will continue to reinforce and verify security for transactions before resuming the PlayStation®Store and other Qriocity operations, scheduled for this month.

[[Q]]

FUCK YEAH free downloads plus free month of playstation plus... that means i'm downloading the free sonic game they had a couple weeks back.

[JaoSming]

iirc you have to stay a plus subscriber to play the games after the free month is over with. and when does the free plus start? when it comes back online this week or when the store comes back later in the month?

[[Q]]

aw man, that sucks then

[[Q]]

May 4th is the highly anticipated day supposedly.
they say it should be up by then
http://mashable.com/2011/04/28/psn-day11/

[kibaxx7]

Loving the free month of Playstation Plus. But as Jao said, not sure if you can keep the games after that month...

[[Q]]

yeah i think you can only keep the games you pay for (the ones that are discounted), which shows the free plus membership is a marketing ploy to save face and at the same time attempt to bring in more sales revenue