136w ago - Update #2: MCST.ca has reported that Canadian Natasha Maksimovic has also filed suit (PDF) against Sony via McPhadden Samac Tuovi LLP for the recent PSN security breach.
Update: MSNBC now reports that Sony's database may already be on sale in an online bazaar, stating that that low-level cybercriminals using "carder" online forums were offering to sell a database of 2.2 million credit-card numbers taken during the PlayStation Network breach.
As a result of yesterday's confirmation from Sony that PSN account information has been compromised, today class action lawsuits are forming against the corporation despite a T&C disagreement that states Sony is not liable for loss of data.
To quote: "We exclude all liability for loss of data or unauthorised access to your data, Sony Online Network account or Sony Online Network wallet and for damage caused to your software or hardware as a result of using or accessing Sony Online Network," the terms state.
According to the documentation, the first of many defendants is Kristopher Johns, 36, of Birmingham, Alabama.
To quote from CNET: "Sony sued for PlayStation Network data breach
Like clockwork, the first lawsuit resulting from the security breach of the personal data of more than 75 million Sony PlayStation Network customers has been filed.
The suit was filed today on behalf of Kristopher Johns, 36, of Birmingham, Ala., in the U.S. District Court for the Northern District of California. Johns accuses Sony of not taking "reasonable care to protect, encrypt, and secure the private and sensitive data of its users."
He also believes Sony took too long to notify him and other customers that their personal information had been exposed. Because of that, the complaint alleges, Sony did not allow its customers "to make an informed decision as to whether to change credit card numbers, close the exposed accounts, check their credit reports, or take other mitigating actions."
The lawsuit is asking for monetary compensation and free credit card monitoring, and is seeking class action status.
Yesterday, Sony warned customers of its PlayStation Network and Qriocity service that their personal information--including customer names, addresses, e-mail addresses, birthdays, PlayStation Network and Qriocity passwords, and user names, as well as online user handles--was obtained illegally by an "unauthorized person" between April 17 and 19. The company says there is "no evidence" that credit card information was compromised, but it can't be sure yet.
In the aftermath of the breach Sony has temporarily turned off PlayStation Network and Qriocity, contracted with an outside security firm to investigate the intrusion on its network, and started to rebuild its system and security.
Johns' complaint echoes the concerns of Sen. Richard Blumenthal, a Connecticut Democrat. Blumenthal yesterday wrote a letter to Jack Tretton, president and chief executive of Sony Computer Entertainment America, saying he was troubled that the company had not notified customers sooner about the breach. He also called for Sony to provide affected customers with financial data security services, including free access to credit reporting services for two years to protect against identity theft."
Also from IGN, to quote: "Sony Sued for PSN Security Breach - Class action lawsuit filed this morning against SCEA.
A class action lawsuit was filed against Sony a day after the company publicly admitted that personal information from PlayStation Network was compromised by a security breach. The lawsuit was filed by the Rothken Law Firm today in a California court and alleges Sony "failed to take reasonable care to protect, encrypt, and secure the private and sensitive data."
Yesterday, Sony said it believes an unauthorized person obtained PSN user information, including members' names, addresses, birthdays, and login passwords. The company said there was no evidence that credit card information was stolen, but did not rule out that possibility.
"We brought this lawsuit on behalf of consumers to learn the full extent of Sony PlayStation Network data security practices and the data loss and to seek a remedy for consumers. We are hopeful that Sony will take this opportunity to learn from the network vulnerabilities, provide a remedy to consumers who entrusted their sensitive data to Sony, and lead the way in data security best practices going forward," said Ira P. Rothken an attorney who filed the class action complaint.
"Sony's breach of its customers' trust is staggering. Sony promised its customers that their information would be kept private. One would think that a large multinational corporation like Sony has strong protective measures in place to prevent the unauthorized disclosure of personal information, including credit card information. Apparently, Sony doesn't," commented J.R. Parker, co-counsel in the case.
The lawsuit seeks monetary compensation for the data loss and "loss of use of the Sony PlayStation Network, credit monitoring, and other relief according to proof."
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
Sony aparently never heard of proper and most of all secure loging to the external / remote systems which has no other direct access from monitored system apart of storing the sent logs itself and indeed constantly backing them up and so on - clueless.
Update: PSN is now back online in Japan, and Kaz Harai has made available a http://blip.tv/play/h5NMgr6pNgI statement with all the related details.
Following news that PSN internal testing is currently underway, today the official http://cdn.jp.playstation.com/msg/state.html site has issued an update regarding the PlayStation Network outage alongside details from the official letter Sony sent out to their publishing partners.
To quote, roughly translated: "PlayStation Network” and “Qriocity” and continued failure, I am sorry indeed. As we told the other day with the latest information in regard to future service restart, will be conducted in stages on a regional basis to ensure the safety of our customers.
We are preparing to be able to resume service as soon as possible in Japan, and is now doing the verification stage for ensuring the safety and security, providing more advanced. Server to complete the relocation of more secure facilities, further strengthening the encryption, firewalls and expansion of new customers with peace of mind again on “PlayStation Network” and “Qriocity” to stay.
We also are supporting the monitoring and the introduction of warning systems to facilitate early detection of cyber attacks, subjected to a system upgrade intended to eliminate vulnerabilities, established a system to ensure information management to protect important personal information of customers.
For those of you committed to ensuring safety, but would take some time for some time now, humbly thank you for your understanding. For the latest information, this website will guide you at any time. To everyone of our customers and partners, we deeply apologize for the inconvenience and inconvenience."
In related news, http://www.industrygamers.com/news/playstation-network-heres-the-official-letter-sony-sent-to-publishing-partners-exclusive/ has shared a copy of the official letter Sony SVP Rob Dyer sent out regarding PSN to their publishing partners, as detailed below:
As you know, certain PlayStation Network, Qriocity and Sony Online Entertainment service user account information was compromised in criminal attacks against our networks. I want to assure you, as a PlayStation partner, that it is Sony’s top priority to restore our network operations and see that business is returned to usual as soon as possible.
We are working around the clock to restore service, but will do so only when we can ensure that the network can operate safely and securely. In the meantime, we greatly appreciate your patience, understanding and goodwill.
On Tuesday, April 19, 2011, Sony discovered that several PlayStation Network servers unexpectedly rebooted themselves and that unplanned and unusual activity was taking place on the network. This activity triggered an immediate response.
Sony mobilized a larger internal team to assist the investigation of the four suspect servers. That team discovered the first credible indications that an intruder had been in the PlayStation Network system, and six more servers were identified as possibly being compromised. Sony immediately decided to shut down all of the PlayStation Network services in order to prevent any additional damage.
The scope and complexity of the investigation grew substantially as additional evidence about the attack developed.
The forensic teams were able to confirm that intruders had used very sophisticated and aggressive techniques to obtain unauthorized access, hide their presence from system administrators and escalate privileges inside the servers. Among other things, the intruders deleted log files in order to hide the extent of their work and activity within the network.
On Sunday May 1, using information uncovered by the forensic teams, engineers at Sony Online Entertainment (SOE) discovered that data had also been taken from their servers. They, too, shut down operations and on Monday, May 2, announced the discovery.
What Data Are Affected?
As you may know, personal data was stolen from approximately 77 million PlayStation network and Qriocity service accounts.
As of this writing, there remains no evidence that the credit card information was stolen and the major credit card companies are still reporting that they have not seen an increase in fraudulent transactions due to this event.
What Steps Are Being Taken?
We have taken aggressive action to give consumers peace of mind, protect them against the abuse of their data, and enhance our security systems moving forward.
We have already advised our consumers in the U.S. that we will offer complimentary identity theft protection services through a leading provider, including an insurance program of up to $1 million. Similar programs are being developed in other markets around the world.
In addition, Sony is taking a series of steps to enhance security of our network infrastructure. They include but are not limited to:
adding additional automated software monitoring and configuration management to help defend against new attacks;
enhanced levels of data protection and encryption, as well as additional penetration and vulnerability testing;
enhanced capabilities to detect software intrusions within the network, unauthorized access and unusual activity patterns;
implementation of additional firewalls;
expediting a planned move of the system to a new data center in a different location with enhanced security; and
appointment of a new Chief Information Security Officer.
Finally, to thank our customers for their patience and loyalty, we are offering them “welcome back” packages as soon as the networks are restored, including free downloads of selected PlayStation entertainment, 30 days of free service as well as service extensions for the number of days PSN and Qriocity services were unavailable, with similar benefits for Music Unlimited subscribers.
We of course deeply regret that this incident has occurred. We are working closely with the FBI to identify and apprehend the culprits who committed this crime against our consumers, our partners and our company. I know you can appreciate how widespread the problem of cybercrime is in society today. Although no company is immune, we are confident our consumer data will be protected by some of the best security measures available today.
As a valued partner we aim to keep the lines of communication open so that you are aware of our progress. Our focus has been to confirm the security of the networks, protect customer data and get the services back on line as quickly as possible. We will do our best to respond to all of your inquiries and we will do everything we possibly can to support you.
We are doing everything we can to bring these services back online as soon as possible. We will update you with more information as soon as we can, but please call your account executive if you have further questions. We thank you for your patience and look forward to moving ahead together in the months and years to come.