Wow, who wants to take a guess and say that the security Sony used for the PSN is similar to what they used for SOE. If true this really amplifies Sony's incompetence, cause if the PSN could be breached, then logic dictates that any other system using similar security methods could also be breached using the same attack methods.
If its completely different then that is another matter, cause any system can be breached with enough effort, however this is yet another massive blow to Sony. An additional 24 million accounts with personal info and thousands of credit cards and debit info have been leaked. Wow... just wow. This must be some kind of record, combined with the PSN this now equals 101 million accounts that have been compromised. Granted of those 77 million PSN accounts probably only about 15 million of them were not alt accounts, but still.
So what else does Sony have that can be breached to lose millions more accounts? PSN and SOE might be the biggest, but whoever is attacking Sony is quite persistent, probably not going to be long before we hear of another attack on some other Sony system that will no doubt cripple them even further.
Maybe this attack is due to CFW and piracy, too? Good job, Sony. I'm curious to see if this breech was done by the same person/people. If not, Sony is screwed - that would indicate a huge, systematic problem, not just some hackers getting into a system. That happens all the time...Sony's just a large player. Multiple exploits across multiple systems by multiple people indicates a major failure in design, both in the application and infrastructure layers.
If it was the same group, that's still not saying much that they were able to break in and get info without being noticed, then break in elsewhere a little later and get even more info. That's still gross incompetence.
Sony Online Entertainment Issues Security Press Release
Here is today's SOE Press Release, doesn't seem like much new from yesterday's initial one though: [Register or Login to view links]
Some of you may have heard today about an announcement from Sony Online Entertainment confirming that they were also victims of a malicious hack. As this could affect those of you with SOE accounts, they have asked us to post their press release on the blog, which should answer some of your questions.
Sony Online Entertainment Announces Theft of Data from Its Systems
Breach believed to stem from initial criminal hack of SOE. Tokyo, May 3, 2011
- Sony Corporation and Sony Computer Entertainment announced today that their ongoing investigation of illegal intrusions into Sony Online Entertainment LLC (SOE, the company) systems revealed yesterday morning (May 2, Tokyo time) that hackers may have stolen SOE customer information on April 16th and 17th, 2011 (PDT). SOE is based in San Diego, California, U.S.A.
This information, which was discovered by engineers and security consultants reviewing SOE systems, showed that personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007. The information from the outdated database that may have been stolen includes approximately 12,700 non-U.S. credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain.
With the current outage of the PlayStation® Network and Qriocity™ services and the ongoing investigation into the recent attacks, SOE had also undertaken an intensive investigation into its system. Upon discovery of this additional information, the company promptly shut down all servers related to SOE services while continuing to review and upgrade all of its online security systems in the face of these unprecedented cyber-attacks.
On May 1, Sony apologized to its customers for the inconvenience caused by its network services outages. The company is working with the FBI and continuing its own full investigation while working to restore all services.
Sony is making this disclosure as quickly as possible after the discovery of the theft, and the company has posted information on its website and will send e-mails to all consumers whose data may have been stolen.
The personal information of the approximately 24.6 million SOE accounts that was illegally obtained, to the extent it had been provided to SOE, is as follows:
• e-mail address
• phone number
• login name
• hashed password.
In addition to the information above, the 10,700 direct debit records from accounts in Austria, Germany, Netherlands and Spain, include:
• bank account number
• customer name
• account name
• customer address.
SOE will grant customers 30 days of additional time on their subscriptions, in addition to compensating them one day for each day the system is down. It is also in the process of outlining a “make good” plan for its PlayStation®3 MMOs (DC Universe Online and Free Realms). More information will be released this week.
Additionally, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.
Sony Online Entertainment LLC (SOE) has been a recognized worldwide leader in massively multiplayer online games since 1999. Best known for its blockbuster hits and franchises, including EverQuest®, EverQuest® II, Champions of Norrath®, PlanetSide®, Free Realms®, Clone Wars Adventures™, and DC Universe Online™, SOE creates, develops and provides compelling online entertainment for virtually all platforms, including the PlayStation®3 Computer Entertainment System, Personal Computer, mobile and social networks. SOE is building on its proven legacy and pioneering the future of the interactive entertainment space through creative development and inspired gameplay design for audiences of all ages. To learn more, visit [Register or Login to view links].
For more information and update about the SOE services, please visit [Register or Login to view links].
So apparently the breach in SOE happened the same time as the PSN breach, however they are only figuring this out now? Sounds like they would have never found out if the PSN breach didn't happen, because they wouldn't have done the investigation into SOE as a precaution.
Either it was a really good hack or their systems are incredibly sub-par (perhaps both).
McPhadden Samac Tuovi LLP has commenced a class action against Sony Corporation and other Sony companies related to the theft from Sony of personal information of PlayStation network and Qriocity service users. The theft may also include user credit card information.
The action has been brought on behalf of all persons in Canada who used Sony's online PlayStation network or Qriocity services up to May 2, 2011, and who provided Sony with personal and/or credit or debit card information.
Additional information about the lawsuit may be found in the firm’s media release, which can be found on this website.
If you would like information about this lawsuit, please contact us directly.
Toronto – May 2, 2011
For Immediate Release
Canadian Sony PlayStation Network Class Action
Sony has announced that personal information for 77 million PlayStation and Qriocity users worldwide, 1 million of which are in Canada, has been hacked. It has been alleged that Sony was aware that such information had been stolen but failed to advise users of PlayStation and Quriocity in a timely fashion.
Sony has acknowledged that stolen information may include users’ names, addresses (city, province, postal code), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID and user profile data, including purchase and usage history and billing address (city, province, postal code), and the subscriber’s PlayStation Network/Qriocity password security answers. The same data with respect to a dependent may also have been obtained.
Sony is not able to say whether user credit card or debit card information was also taken. Sony has acknowledged and apologized for breach. To date, the only compensation Sony has offered is 30 or 60 day free memberships on its PlayStation network. While Sony has advised American users about the availability of free credit reports, it has yet to advice Canadian users about credit reports.
The Toronto law firm McPhadden Samac Tuovi LLP has commenced a proposed class action against Sony Japan, Sony USA, Sony Canada and other Sony entities (“Sony”) for the breach of privacy. The lawsuit claims damages in excess of $1 billion, which includes having Sony pay the costs of credit monitoring services and fraud insurance coverage for two years.
The plaintiff in the action is 21 year old Mississauga resident who has been an avid PlayStation user for years. Natasha Maksimovic said: “If you can’t trust a huge multi-national corporation like Sony to protect your private information, who can you trust. It appears to me that Sony focuses more on protecting its games than its PlayStation users.”