Sony's CEO has forwarded a remarkable new rationale for his company's recent catastrophic network security failures. Howard Stringer warned last week that the April hacker thefts of millions of his customers' personal records are a prelude to global digital horrors. "It's not a brave new world," he told the media. "It's a bad new world."

Preaching Armageddon as a PR response to a corporation's own faulty technology and service is an unlikely tactic, especially when continuing attacks this very week show that Sony has clearly not eliminated its vulnerabilities. It's not our mess, Stringer seems to be implying with his dramatic blame shifting. It's the world's mess.

What's strange about this is that it seems to undercut an apology by Kaz Hirai, the head of Sony's gaming division, delivered ten days after the intrusion. Reuters called Stringer's comments "a stark departure from the remorseful tone struck just two weeks ago." Just last week the company offered an apology package, including a 12-month free identity protection program, free games and free content. Though late in coming, those were strong moves.

Yet Stringer's comments suggest Sony does not truly feel sorry for how badly it has treated its customers. What this bizarre narrative demonstrates is that Stringer and Sony are stuck in the first stages of grief: Not over the harm they have inflicted upon their customers, but in the potentially irreparable damage they have done to themselves and their brand.

Stage one of grief is shock and denial, stage two is pain and guilt, and stage three is anger and bargaining. Sony has gone through the first two stages and now Stringer is lashing back at critics who have blasted the firm for everything from its substandard security to an indefensible delay in alterting tens of millions of customers -- many of them children -- that personal and credit records were stolen. "Forty-three percent (of companies) notify victims within a month," a feisty Stringer told reporters last week in his first public statement since the April break-ins. "You're telling me my week wasn't fast enough?"

It was a bizarre statistical crutch to rely upon to defend what's widely considered one of the worst network security gaffes in history. Why compare your firm to average companies? Especially when New York's Attorney General and Congress are demanding Sony turn over detailed information about its security breakdown. Like how it allowed hackers to steal the names, addresses, email addresses, birthdays, and PlayStation Network login details of over 100 million customers.

But Stringer's most surprising plot twist was to attempt to divert scrutiny of Sony's problems with a wild claim of impending doom. Stringer told the media that one day hackers may strike at the power grid, air traffic controllers, or the global financial system.

Is Stringer Rumpolstillskin? Hackers have been attacking the Internet and high-tech companies for more than two decades. In 1990, I wrote about Rober Morris, the Harvard graduate who launched the first Internet worm, a science experiment gone awry that disabled a large chunk of the budding network. In the mid '90s I wrote The Fugitive Game and The Watchman, two books about the hackers, Kevin Mitnick and Kevin Poulsen, that showed the deep vulnerability of the Internet and major corporations to criminal intrusions.

Every major firm doing business on the Internet knows that their potential -- and Achilles' heel -- is the Internet. Google, Facebook, Microsoft and hundreds more corporations have known this for a very long time. The Internet makes these companies billions in profit. Doing business responsibly on the Internet -- and taking extraordinary care for the personal records and privacy of your customers -- is nothing short of a sacred duty.

Quite simply, Sony abandoned its duty, and Stringer is steaming mad about that internal breakdown because he knows that it threatens Sony's future. The timing couldn't be worse. This week Sony posted a $3.2 billion loss, due in part to the March earthquake and tsunami. The CEO has declared that Sony did everything possible to prevent the break-ins. That is denial. We've seen this broken narrative before. It is not taking the high road. It does not work. Congress, investigative journalists and hackers will eventually reveal the truth, and it will prove even more costly to the company's tattered reputation (Experts have already predicted the breach will cost Sony nearly $1 billion). We will learn that Sony engineers and officials knew of inherent internal weaknesses. That it had plans to roll out a new, more secure system. That it could have taken far more steps to prevent or reduce the harm to its customers.

Sony's story won't play. It won't play because it is not authentic, and it won't play because Stringer can't seem to remember his own narrative. Security -- and honest communication -- requires consistency. In the same week that Stringer declared the attacks on Sony had ushered in a "bad new world," he called the crisis "a hiccup in the road to a network future."

Which is it -- trivial or cataclysmic? And what a strange, disconnected way to talk about a potential disaster for tens of millions of Sony customers? Would you like threats to your financial and personal security to be seen by Sony as nothing more than hiccup?

And what of Stringer's suggestion that the future does not hold "a brave new world" but a "bad new world?" On top of everything else, Stringer apparently is ignorant of the meaning of a "brave new world." In reaching for a sound bite, Sony made another gaffe.

Perhaps the embattled CEO or someone on his communications team should have bothered to read the Wikipedia page on Aldous Huxley's 1932 book, Brave New World. Stringer shot himself in the foot. Huxley himself described Brave New World as a "nightmare." The Wikipedia page says that the dystopian sci-fi novel explored the "fear of losing individual identity in the fast-paced world of the future."

Indeed.

The onslaught against Sony apparently continues: this time hackers have reportedly targeted Sony Music Entertainment Japan and Sony Ericsson's eShop.

Meanwhile, a Sony spokeswoman confirmed today that e-mails, phone numbers, and passwords of more than 8,000 accounts at Sony Music Greece had been stolen over the weekend.

"Sony Music Entertainment Greece learned late Sunday about a data breach involving certain Sony Music Greece Web sites" (which was reported yesterday), the statement said. "These sites, which were artist Web sites allowing fans to sign up for newsletters, were taken down immediately. Approximately 8,500 records containing e-mail addresses, telephone numbers, user names, and passwords were obtained; however, the sites did not offer any commerce activity and therefore no credit card data was involved. The affected sites were hosted by a third party and were not part of the Sony Music Entertainment network. Sony Music Entertainment Greece plans to re-launch the sites as soon as possible after further security review."

It's unknown who is behind that attack, which is one of a series targeting Sony sites in the wake of breach last month at Sony PlayStation Network (PSN) and Sony Online Entertainment (SOE) that exposed user data from more than 100 million accounts.

In the latest news, a hacker group called "LulzSec" said it used an SQL Injection attack to grab information behind two sites associated with Sony Music Entertainment Japan, according to a report on The Hacker News.
"This isn't a 1337 h4x0r, (elite hack) we just want to embarrass Sony some more," the group wrote on its Pastebin post. "Stupid Sony, so very stupid."
LulzSec announced the hack in a Tweet, which was picked up by The Hacker News. Of the two Sony sites listed by LulzSec, one was inaccessible midday today and the other was up.

And in yet another hack, a Lebanese hacker group known as "Idahca" also used an SQL injection attack to steal data from Sony Ericsson's eShop, the hacker news site also reported today. "E-mail, password, and names of thousands of users were exposed via text file on Pastebin," the report said.
The Sony Ericsson eShop site, its official online store, was down with a message that said "D'oh! The page you are looking for has gone walkabout. Sorry." Meanwhile, there was no data on the Pastebin link provided by the report.

A Sony spokeswoman said the company was looking into the Sony Music Entertainment Japan situation. On the Sony Ericsson matter, she referred CNET to a spokesperson at Sony Ericsson who did not immediately respond to an e-mail seeking comment.

In addition to a distributed denial-of-service attack the group Anonymous launched on Sony in early April and the unconfirmed Sony Music Japan and Sony Ericsson hacks, there have been attacks on PSN, SOE, Sony Music Greece, Sony Music Indonesia, Sony's Japanese ISP subsidiary So-net Entertainment, and Sony Thailand's site.

Sony also had to take PSN down last week after finally restoring the service following the breach because of a log-in exploit. And Sony took PSN offline again today for maintenance work that the company says is not related to a security issue.

Sony's been hacked. Again. In three more countries. The music giant confirmed that it had to shut down the Sony Ericsson Mobile Communications shopping website in Canada after thieves stole personal information for about 2,000 customers. Time's TechLand blog reports that half of that customer data has already been posted online.

A Lebanese hacking group is reportedly taking credit for the break-in and claims it had access to—but chose not to steal—customer credit card data as well, reports the Daily Tech.

Two other Sony sites were also shuttered: Sony said it discovered its site in Thailand may have been compromised with malicious code that sends out fake e-mails. And the company is investigating whether similar tampering by hackers might have occurred with Sony's website in Indonesia.

The attacks, including the recent hack of Sony's BMG music site in Greece, come on the heels of Sony's PlayStation Network meltdown—a fiasco that is expected to cost the company $171 million this quarter. A Japanese financial analyst told Bloomberg:

“What looked like a game-related attack in the U.S. is spreading to other businesses such as music and to all over the world. It may take significantly longer than expected for Sony to get over this."

The recent hacking of Sony has revealed how much the corporate denizens conspired to keep their CEO Howard Stringer in the dark at the outfit.

It turned out that Sony was hacked in 2008 and Stringer's minions forgot to actually mention it to him.

Sony boss Sir Howard Stringer claims in an interview with Bloomberg to have known nothing about the previous intrusion and, given the way Sony reacted to the recent hack, we believe him.

Stringer's view was that the network would not be attacked because it gave people services for free and it didn't seem like the likeliest place for an attack.
He might have held a different view if he had known that the network was attacked twice in 2008. A British teen got into Sony's developer network and there was a hack into PlayStation Home.

Sony told Bloomberg that when one incident that related to PlayStation Network, once it identified what it was, they went in and fixed it
But Sony did not tell Stringer, neither did it order the development of a decent security policy which required servers to be regularly updated and firewalled.

One of Sony's polices included an upgrade that prevented users installing Linux on the machines. It seems that the outfit was simply complacent and its senior management were kept ignorant about the state of its security.

How crap is that?