Sony woes continue as SOE confirms data breach (update: 24.6 million accounts affected)
BY TIM STEVENS
POSTEDMAY 2ND 2011 08:29PM

Are you starting to feel bad for Sony yet? No? Maybe this will change your mind. Sony Online Entertainment has, apparently, been the victim of another breach that has, according to Nikkei.com, resulted in the release of 12,700 credit card numbers -- and presumably some other information as well. 4,300 of those credit card numbers are said to be Japanese, but no saying how many are American. Thankfully, data is said to be from 2007, minimizing the number of still-valid credit cards exposed making us wonder if perhaps this wasn't some sort of backup that was exposed. Regardless, SOE's online services were taken offline earlier today and, well, now we know why. We're presently expecting further information from the company but, until then, feel free to continue cowering in the corner and quietly sobbing onto your compromised credit cards.

[Warning: subscription required]

Update: According to the Wall Street Journal, Sony has also confirmed that the latest attack accessed personal information for a staggering 24.6 million accounts. Such info includes names, addresses, telephone numbers, email addresses, gender, date of birth, login ID, and hashed passwords. Ruh roh.

(CNN) -- Sony said the Internet security breach targeting its networks was more extensive than originally thought.

Hackers also gained access to databases containing subscriber information for Sony Online Entertainment, a San Diego subsidiary that makes online multiplayer games for computers and the PlayStation 3. The Sony division took its Web services offline Monday.

That shutdown came 12 days after Sony Computer Entertainment disconnected the PlayStation console game network and Sony Network Entertainment shut down Qriocity media streaming services. Sony said last week that it expected to start restoring some services this week, but they remain offline.

Sony disclosed the first breach on April 22, and then on April 27, the company announced that personal info and perhaps credit card numbers had been stolen for as many as 77 million accounts.

With the PC game network also compromised, Sony adds 24.6 million accounts to the pot. Some popular games maintained by Sony's online division include "EverQuest," "DC Universe Online" and "Free Realms."

This additional network was targeted on April 16 and April 17, the same days the other networks were hacked. While the infrastructures are separate, "There's a degree of architecture that overlaps" among Sony's many networks, said Michele Sturdivant, a spokeswoman for Sony Online Entertainment.

"Initially, we believed that data was not stolen," she said, but then the company uncovered evidence to the contrary during its ongoing investigation. "They used very sophisticated means to access the data, and they used sophisticated means to cover their tracks."

The information hackers took from Sony Online Entertainment's system included users' names, home addresses, e-mail addresses, phone numbers, login names, encrypted passwords, birth dates and genders. Unlike the last breach, hackers didn't get the answers to security questions or have access to most people's financial information.

However, information from an additional 12,700 users stored on a database that was retired in 2007 was also compromised, Sony said. The data there included credit and debit-card numbers and expiration dates, but not security codes, for non-United States residents, as well as direct-debit banking records for some customers in Austria, Germany, the Netherlands and Spain.

Sony apologized for the security lapse and outages on Sunday. The company plans to offer PlayStation account holders a 30-day voucher for the PlayStation Plus service, which lets gamers download free and exclusive games. Current Plus subscribers will get an extra 30 days added to their accounts.

Similarly, Sony Online Entertainment will add 30 days to customers' accounts, along with additional play time for each day the service is down. The company also says it is in the process of outlining how it will recompense gamers who own its PlayStation 3 games. Additionally, Sony will offer complimentary assistance for customers who want to enroll in identity theft protection programs.

Sony says it's working with the Federal Bureau of Investigation to make sense of the security breach. On Monday, PlayStation spokesman Patrick Seybold denied a report that said the hacker group offered to sell Sony a list of credit card numbers stolen from its systems.

In the course of its investigation into the PlayStation Network security breach, Sony discovered a file that makes a clear reference to the “Anonymous” hacking group.

In a letter to the U.S. House of Representatives on Wednesday, Sony said a file named “Anonymous,” containing the words “We Are Legion,” was left behind by the intruders who gained access to the servers of Sony Online Entertainment, the company’s game development and distribution arm. The intruders in that breach compromised information on 24.6 million users, as well as 20,000 credit card and bank account numbers.

Sony discovered the SOE breach on Sunday while investigating an earlier attack that compromised information on 77 million accounts from Sony’s PlayStation Network and Qriocity services in April. Anonymous has not been linked to the PlayStation Network breach — the first one detected. However, Sony noted that both breaches took place in the same time frame, which also corresponded with a denial-of-service campaign launched by Anonymous in retaliation for Sony’s lawsuit against PlayStation tinkerer George Hotz.

Members of the House Committee on Energy and Commerce held a hearing Wednesday to address the subject of data theft and its potential impact on consumers. Sony Computer Entertainment CEO Kaz Hirai did not attend, but sent written responses to the House Subcommittee on Commerce, Manufacturing and Trade. Sony summarized the content of Hirai’s letter on its official PlayStation blog, saying that it had suffered from a “very carefully planned, very professional, highly sophisticated criminal cyberattack.”

Sony said it knew how the intrusion was accomplished, but not who was responsible.


Photocopies of the letter were also made available. The letter details the company’s actions over the past two weeks and says Sony acted with “care and caution” while deciding how to act and when to inform companies of the security breach, .

On the afternoon of April 20, Sony first discovered evidence of an unauthorized intrusion, the company said in the letter. It then took down the PlayStation Network servers.

Over the next five days, the company hired multiple security firms and forensic teams to determine the scope of the breach. On April 25, Sony found that hackers could have obtained personal information for 77 million PSN accounts, and it informed customers of the breach on the following day.

Sony did not inform customers prior to April 26, because it did not want to “cause confusion and lead [customers] to take unnecessary actions,” the company said.

Major credit card companies have still not reported any fraud that they believe is directly related to the attack, Sony said, adding that 12.3 million customers had credit card information stored on the PlayStation Network, including 5.6 million in the United States. Sony says those credit card numbers were stored encrypted.

Sony added on Monday that its Sony Online Entertainment services had also been affected by the hack, and that hackers may have obtained personal information for its 24.6 million users. As of Wednesday, the company’s Facebook and other online game services have not been taken back online.

Sony said it plans to bring some of PlayStation Network’s services back up this week. As a goodwill gesture, customers will receive 30 free days of PlayStation Plus as well as a variety of free downloads.

Posted at 08:58 AM ET, 05/05/2011
Sony details PlayStation Network attack, but no timeline for service restoration
By Hayley Tsukayama

The PlayStation Network (PSN), which has been offline following an attack that leaked millions of consumers’ personal data is expected to be at least partially restored some time this week. But SOE only said that its services would be back up “soon.”

The division is notifying customers who may have been affected by the hack through e-mail sent a third-party distributor. E-mails from SOE will contain either “soe.innovyx.net” or “soe.sony.com” in the sender field.

As for a few more details about the attack, Sony said that the SOE incident was not a new attack, but another similar attack discovered in the course of investigation into the PSN breach. SOE had originally reported that no customer data had been extracted in the attack, then changed its story in a May 2 release.

The division said that the perpetrators used sophisticated techniques to cover their tracks, which is why Sony did not initially know that SOE data had also been stolen.

Both the PSN and SOE have announced “make good” gestures for their customers, offering a month of some services to all members, as well as additional free days for subscribers make up the days lost while the company investigates the breach.

SOE has also outlined the plan to compensate players of its DC Universe Online game — in addition to 30 days of subscription credit and being compensated for days the network is down, players will also get a Batman-inspired mask when the game is up again.

players will also get a Batman-inspired mask when the game is up again.