196w ago - Playstation Blog updated with latest info:
Thank you for your patience while we work to resolve the current outage of PlayStation Network & Qriocity services. We don't have an exact date to share at this moment as to when we will have the services turned on, but are working day and night to ensure it is as quickly as possible. We are currently working to send the following message via email to all of our registered account holders regarding a compromise of personal information as a result of this malicious attack on our servers, so please look for this information via email as well. Please note that we are as upset as you are regarding this attack and are going to proceed aggressively to track down those that are responsible.
Source, full text and letter (plus interresting comments below) here: [Register or Login to view links]
Valued PlayStation Network/Qriocity Customer,
We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network. In response to this intrusion, we have:
1) Temporarily turned off PlayStation Network and Qriocity services;
2) Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and
3) Quickly taken steps to enhance security and strengthen our network infrastructure by re-building our system to provide you with greater protection of your personal information.
We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.
Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity passwords and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, to be on the safe side we are advising you that your credit card number (excluding security code) and expiration date may also have been obtained.
For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security, tax identification or similar number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.
To protect against possible identity theft or other financial loss, we encourage you to remain vigilant to review your account statements and to monitor your credit or similar types of reports.
We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please check [Register or Login to view links] should you have any additional questions.
Sony Network Entertainment and Sony Computer Entertainment Teams
Sony Network Entertainment Europe Limited (formerly known as PlayStation Network Europe Limited) is a subsidiary of Sony Computer Entertainment Europe Limited the data controller for PlayStation Network/Qriocity personal data.
McPhadden Samac Tuovi LLP has commenced a class action against Sony Corporation and other Sony companies related to the theft from Sony of personal information of PlayStation network and Qriocity service users. The theft may also include user credit card information.
The action has been brought on behalf of all persons in Canada who used Sony's online PlayStation network or Qriocity services up to May 2, 2011, and who provided Sony with personal and/or credit or debit card information.
Additional information about the lawsuit may be found in the firm’s media release, which can be found on this website.
If you would like information about this lawsuit, please contact us directly.
Toronto – May 2, 2011
For Immediate Release
Canadian Sony PlayStation Network Class Action
Sony has announced that personal information for 77 million PlayStation and Qriocity users worldwide, 1 million of which are in Canada, has been hacked. It has been alleged that Sony was aware that such information had been stolen but failed to advise users of PlayStation and Quriocity in a timely fashion.
Sony has acknowledged that stolen information may include users’ names, addresses (city, province, postal code), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID and user profile data, including purchase and usage history and billing address (city, province, postal code), and the subscriber’s PlayStation Network/Qriocity password security answers. The same data with respect to a dependent may also have been obtained.
Sony is not able to say whether user credit card or debit card information was also taken. Sony has acknowledged and apologized for breach. To date, the only compensation Sony has offered is 30 or 60 day free memberships on its PlayStation network. While Sony has advised American users about the availability of free credit reports, it has yet to advice Canadian users about credit reports.
The Toronto law firm McPhadden Samac Tuovi LLP has commenced a proposed class action against Sony Japan, Sony USA, Sony Canada and other Sony entities (“Sony” for the breach of privacy. The lawsuit claims damages in excess of $1 billion, which includes having Sony pay the costs of credit monitoring services and fraud insurance coverage for two years.
The plaintiff in the action is 21 year old Mississauga resident who has been an avid PlayStation user for years. Natasha Maksimovic said: “If you can’t trust a huge multi-national corporation like Sony to protect your private information, who can you trust. It appears to me that Sony focuses more on protecting its games than its PlayStation users.”
So apparently the breach in SOE happened the same time as the PSN breach, however they are only figuring this out now? Sounds like they would have never found out if the PSN breach didn't happen, because they wouldn't have done the investigation into SOE as a precaution.
Either it was a really good hack or their systems are incredibly sub-par (perhaps both).
Here is today's SOE Press Release, doesn't seem like much new from yesterday's initial one though: [Register or Login to view links]
Some of you may have heard today about an announcement from Sony Online Entertainment confirming that they were also victims of a malicious hack. As this could affect those of you with SOE accounts, they have asked us to post their press release on the blog, which should answer some of your questions.
Sony Online Entertainment Announces Theft of Data from Its Systems
Breach believed to stem from initial criminal hack of SOE. Tokyo, May 3, 2011
- Sony Corporation and Sony Computer Entertainment announced today that their ongoing investigation of illegal intrusions into Sony Online Entertainment LLC (SOE, the company) systems revealed yesterday morning (May 2, Tokyo time) that hackers may have stolen SOE customer information on April 16th and 17th, 2011 (PDT). SOE is based in San Diego, California, U.S.A.
This information, which was discovered by engineers and security consultants reviewing SOE systems, showed that personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007. The information from the outdated database that may have been stolen includes approximately 12,700 non-U.S. credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain.
With the current outage of the PlayStation® Network and Qriocity™ services and the ongoing investigation into the recent attacks, SOE had also undertaken an intensive investigation into its system. Upon discovery of this additional information, the company promptly shut down all servers related to SOE services while continuing to review and upgrade all of its online security systems in the face of these unprecedented cyber-attacks.
On May 1, Sony apologized to its customers for the inconvenience caused by its network services outages. The company is working with the FBI and continuing its own full investigation while working to restore all services.
Sony is making this disclosure as quickly as possible after the discovery of the theft, and the company has posted information on its website and will send e-mails to all consumers whose data may have been stolen.
The personal information of the approximately 24.6 million SOE accounts that was illegally obtained, to the extent it had been provided to SOE, is as follows:
• e-mail address
• phone number
• login name
• hashed password.
In addition to the information above, the 10,700 direct debit records from accounts in Austria, Germany, Netherlands and Spain, include:
• bank account number
• customer name
• account name
• customer address.
SOE will grant customers 30 days of additional time on their subscriptions, in addition to compensating them one day for each day the system is down. It is also in the process of outlining a "make good" plan for its PlayStation®3 MMOs (DC Universe Online and Free Realms). More information will be released this week.
Additionally, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.
Sony Online Entertainment LLC (SOE) has been a recognized worldwide leader in massively multiplayer online games since 1999. Best known for its blockbuster hits and franchises, including EverQuest®, EverQuest® II, Champions of Norrath®, PlanetSide®, Free Realms®, Clone Wars Adventures™, and DC Universe Online™, SOE creates, develops and provides compelling online entertainment for virtually all platforms, including the PlayStation®3 Computer Entertainment System, Personal Computer, mobile and social networks. SOE is building on its proven legacy and pioneering the future of the interactive entertainment space through creative development and inspired gameplay design for audiences of all ages. To learn more, visit [Register or Login to view links].
For more information and update about the SOE services, please visit [Register or Login to view links].
Maybe this attack is due to CFW and piracy, too? Good job, Sony. I'm curious to see if this breech was done by the same person/people. If not, Sony is screwed - that would indicate a huge, systematic problem, not just some hackers getting into a system. That happens all the time...Sony's just a large player. Multiple exploits across multiple systems by multiple people indicates a major failure in design, both in the application and infrastructure layers.
If it was the same group, that's still not saying much that they were able to break in and get info without being noticed, then break in elsewhere a little later and get even more info. That's still gross incompetence.