Incident 2day
Sony said it learned of the breach in its popular PlayStation Network on April 19, prompting it to shut down the network immediately. Sony did not tell the public about the stolen data until Tuesday, hours after it launched its new tablet computers in Japan.
An "illegal and unauthorized person" obtained names, addresses, email addresses, birth dates, usernames, passwords, logins, security questions and more, Sony said on its U.S. PlayStation blog on Tuesday.
A Sony spokesman said it took "several days of forensic investigation" after learning of the breach before the company knew consumers' data had been compromised.
The news sparked fury among users.
"If you have compromised my credit information, you will never receive it again," read one message on the PlayStation Network blog from a user under the name Korbei83.
"The fact that you've waited this long to divulge this information to your customers is deplorable. Shame on you."
The electronics conglomerate is the latest Japanese company to come under fire for not disclosing bad news quickly. Tokyo Electric Power Co was criticized for how it handled the nuclear crisis after the March 11 earthquake. Last year, Toyota Motor Corp was slammed for being less than forthright about problems over a massive vehicle recall.
The shutdown of the PlayStation Network prevented owners of Sony's video game console from buying and downloading games, as well as playing with rivals over the Internet.
Sony said it could restore some of the network's services within a week.
Alan Paller, research director of the SANS Institute, said the breach may be the largest theft of identity data information on record.
The online network was launched in the autumn of 2006 and offers games, music and movies to people with PlayStation consoles. It had 77 million registered users as of March 20, a Sony spokesman said, almost 90 percent of them in Europe or the United States.
Sony shares fell 0.3 percent in Tokyo by 0240 GMT, underperforming a 0.8 percent rise in the benchmark Nikkei index.
MAJOR SETBACK
The breach is a major setback for the Japanese electronics maker. Although video game hardware and software sales have declined globally, the PlayStation franchise is a substantial profit source and remains a flagship product for Sony.
Sony intends to use PlayStation games to lure consumers to buy its first tablet computers. The company will start selling the tablets later this year to compete against Apple Inc's iPad and aims to overtake Samsung Electronics to become No. 2 in the burgeoning market.
The company also plans to launch a new hand-held games device, the Next Generation Portable, by the end of the year.
Children with accounts established by their parents also might have had their data exposed, Sony said.
Sony said it saw no evidence credit card numbers were stolen, but warned users it could not rule out the possibility.
"Out of an abundance of caution, we are advising you that your credit card number (excluding security code) and expiration date may have been obtained," Sony said.
Analysts said that while Sony has notified customers of the breach, it had still not provided information on how user data might have been compromised.
"This is a huge data breach," said Wedbush Securities analyst Michael Pachter, who estimated Sony generates $500 million in annual revenue from the service. "The bigger issue with Sony is how will the hacker use the info that has been illegally obtained?"
Sony said it had hired an "outside recognized security firm" to investigate.
The company said user account information for the PlayStation Network and its Qriocity service users was compromised between April 17 and April 19.
Paller said Sony probably did not pay enough attention to security when it was developing the software that runs its network. In the rush to get out innovative new products, security can sometimes take a back seat.
"They have to innovate rapidly. That's the business model," Paller said. "New software has errors in it. So they expose code with errors in it to large numbers of people, which is a catastrophe in the making."
He suspected the hackers entered the network by taking over the PC of a system administrator, who had rights to access sensitive information about Sony's customers. They likely did that by sending the administrator an email message that contained a piece of malicious software that got downloaded onto his or her PC.
Hackers have stolen personal data in the past from large companies. In 2009, Albert Gonzalez pleaded guilty to stealing tens of millions of payment card numbers by breaking into corporate computer systems at companies such as 7-Eleven Inc and Target Co.
Sony said its users could place fraud alerts on their credit card accounts through three U.S. credit card bureaus, which it recommended in its statement.
The company declined to comment on whether it was working with law enforcement or other parties in its investigation.
Sony has reported the breach to Federal Bureau of Investigations, the New York Times reported on its website. Democrat senator Richard Blumenthal also sent a letter to the Japanese firm asking it to explain why it didn't notify PlayStation owners sooner.
An "illegal and unauthorized person" obtained names, addresses, email addresses, birth dates, usernames, passwords, logins, security questions and more, Sony said on its U.S. PlayStation blog on Tuesday.
A Sony spokesman said it took "several days of forensic investigation" after learning of the breach before the company knew consumers' data had been compromised.
The news sparked fury among users.
"If you have compromised my credit information, you will never receive it again," read one message on the PlayStation Network blog from a user under the name Korbei83.
"The fact that you've waited this long to divulge this information to your customers is deplorable. Shame on you."
The electronics conglomerate is the latest Japanese company to come under fire for not disclosing bad news quickly. Tokyo Electric Power Co was criticized for how it handled the nuclear crisis after the March 11 earthquake. Last year, Toyota Motor Corp was slammed for being less than forthright about problems over a massive vehicle recall.
The shutdown of the PlayStation Network prevented owners of Sony's video game console from buying and downloading games, as well as playing with rivals over the Internet.
Sony said it could restore some of the network's services within a week.
Alan Paller, research director of the SANS Institute, said the breach may be the largest theft of identity data information on record.
The online network was launched in the autumn of 2006 and offers games, music and movies to people with PlayStation consoles. It had 77 million registered users as of March 20, a Sony spokesman said, almost 90 percent of them in Europe or the United States.
Sony shares fell 0.3 percent in Tokyo by 0240 GMT, underperforming a 0.8 percent rise in the benchmark Nikkei index.
MAJOR SETBACK
The breach is a major setback for the Japanese electronics maker. Although video game hardware and software sales have declined globally, the PlayStation franchise is a substantial profit source and remains a flagship product for Sony.
Sony intends to use PlayStation games to lure consumers to buy its first tablet computers. The company will start selling the tablets later this year to compete against Apple Inc's iPad and aims to overtake Samsung Electronics to become No. 2 in the burgeoning market.
The company also plans to launch a new hand-held games device, the Next Generation Portable, by the end of the year.
Children with accounts established by their parents also might have had their data exposed, Sony said.
Sony said it saw no evidence credit card numbers were stolen, but warned users it could not rule out the possibility.
"Out of an abundance of caution, we are advising you that your credit card number (excluding security code) and expiration date may have been obtained," Sony said.
Analysts said that while Sony has notified customers of the breach, it had still not provided information on how user data might have been compromised.
"This is a huge data breach," said Wedbush Securities analyst Michael Pachter, who estimated Sony generates $500 million in annual revenue from the service. "The bigger issue with Sony is how will the hacker use the info that has been illegally obtained?"
Sony said it had hired an "outside recognized security firm" to investigate.
The company said user account information for the PlayStation Network and its Qriocity service users was compromised between April 17 and April 19.
Paller said Sony probably did not pay enough attention to security when it was developing the software that runs its network. In the rush to get out innovative new products, security can sometimes take a back seat.
"They have to innovate rapidly. That's the business model," Paller said. "New software has errors in it. So they expose code with errors in it to large numbers of people, which is a catastrophe in the making."
He suspected the hackers entered the network by taking over the PC of a system administrator, who had rights to access sensitive information about Sony's customers. They likely did that by sending the administrator an email message that contained a piece of malicious software that got downloaded onto his or her PC.
Hackers have stolen personal data in the past from large companies. In 2009, Albert Gonzalez pleaded guilty to stealing tens of millions of payment card numbers by breaking into corporate computer systems at companies such as 7-Eleven Inc and Target Co.
Sony said its users could place fraud alerts on their credit card accounts through three U.S. credit card bureaus, which it recommended in its statement.
The company declined to comment on whether it was working with law enforcement or other parties in its investigation.
Sony has reported the breach to Federal Bureau of Investigations, the New York Times reported on its website. Democrat senator Richard Blumenthal also sent a letter to the Japanese firm asking it to explain why it didn't notify PlayStation owners sooner.
Posted in: Technology
0 comments:
Post a Comment