Sony Sued For PlayStation Network Data Breach

suraj.sun writes "Like clockwork, the first lawsuit resulting from the security breach of the personal data of more than 75 million Sony PlayStation Network customers has been filed. The suit was filed today on behalf of Kristopher Johns, 36, of Birmingham, Ala., in the US District Court for the Northern District of California. Johns accuses Sony of not taking 'reasonable care to protect, encrypt, and secure the private and sensitive data of its users.' He also believes Sony took too long to notify him and other customers that their personal information had been exposed. Because of that, the complaint alleges, Sony did not allow its customers 'to make an informed decision as to whether to change credit card numbers, close the exposed accounts, check their credit reports, or take other mitigating actions.'"

Comments

First of all...

[Anonymous Coward]

That'll teach them.

Re:First of all...

[an unsound mind]

Sony as an example of quality?

Are you trolling us?

Sony hardware is just as good quality-wise as the rest; only their prices are quite a bit above.

Re:First of all...

[Leebert]

Sony hardware is just as good quality-wise as the rest; only their prices are quite a bit above.

These days. Back in the days of the green power button, you could count on Sony to produce a pretty darn good product that was at least as good as any other competitor.

Re:First of all...

[shadowfaxcrx]

And their professional stuff still is damned good. Unfortunately, few of us want to spend 50 grand on a camcorder. Their consumer stuff is, when you take the price into account, junk.

So it begins...

[Anonymous Coward]

the great battle of our time...

Re:So it begins...

[Chookah]

Class action anybody?

Re:So it begins...

[Kagato]

A handful of lawyers will get rich. The only thing you might get is some credit monitoring out of it.

Re:So it begins...

[cheater512]

Which would probably be extremely beneficial considering what information got stolen.

Re:So it begins...

[calderra]

Yeah, SCOTUS just ruled (after Congress voted) that companies can decide you don't get to file a class action suit, forcing you into single arbitration instead. And with AT&T as a model, they don't really have to notify you, they just have to pose an updated EULA that says "continued use of this service...". So individual citizens are now a lower social caste than corporations, basically.

Re:So it begins...

[nschubach]

Names, addresses and maybe passwords with the unknown/slight chance of credit card data? They haven't said that CC data was stolen, but that the hacker MIGHT have had access to some of it.

Re:So it begins...

[geekoid]

More accurately:

" While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility."

That reads to me as 'they had an opportunity, we don't know if they took anything. And if the person(s) that did that did it correctly, they will never know until after unauthorized CC use starts appearing, or a reasonable time goes by, like a year.

Re:So it begins...

[kelemvor4]

And they certainly used the evasive language so folks like you would assume that the hacker wanted names, addresses etc from users but out of the goodness of their heart decided to leave the money alone.

I cancelled my card the moment I saw the press release, and I'd gladly participate in a class action. When you give a company your details (especially credit card information) they generally try to assure you that your information is safe with them. That was the case with Sony. So what they said and what they did; two different things. Sony needs to be held accountable for the gross negligence that allowed this hack to be so wildly successful.

not taking reasonable care

[Anonymous Coward]

I'm not sure I buy that first part, given that no online service is ever going to be 100% secure. I understand that one should take prudent steps toward making a "best effort" in that regard, but at the end of the day, if some well-funded crime kingpin wants in, there probably isn't much you'd be able to do about it. It's the second one that has my blood boiling in sympathy, partly because this is practically Sony's trademark: if something goes wrong with their products, don't go public with it, don't acknowledge it, don't even think about it, and maybe it will go away!

Re:not taking reasonable care

[Labcoat Samurai]

Maybe this lawsuit will require them to come forward with the steps they *did* take. Up until now, it's largely been speculation. If they locked the door but left open a window, I want to know. And I want to know how open that window was left.

Re:not taking reasonable care

[Darkness404]

The problem is that it is never a "well funded crime kingpin" and most often a 15-30 year old or an (ex) employee that noticed some gaping, obvious security flaw. Data breaches like this are rarely the work of huge "cyber gangs" and mostly the work of individuals who noticed some huge flaw that Sony had. The crime kingpins wouldn't bother with something like this because it is a whole lot easier to sell botnets with 3nl@rg3 y0ur p3n15 spam.

Re:not taking reasonable care

[mysidia]

I'm not sure I buy that first part, given that no online service is ever going to be 100% secure.

Reasonable care would imply robustly isolating transaction processing systems and user accessible systems from systems that store primary account numbers such as credit card/bank account numbers from online/public access systems such as the internet, or the playstation network.

Reasonable care would include complying with PCI requirements, relating to auditing, security practices, separation of computer systems by role, and enforcing strong unique access credentials for users and systems.

So that a compromise of the publicly accessible network cannot lead to compromise of the account numbers.

This is highly doable. The only commands/services the PSN/publicly accessible servers need from account servers is a command to "add a new account number" to the database linked to a certain customer, a command to "erase an account number", a command to list privacy-filtered summary to display a 'delete' user interface, and a command "authorize/charge a transaction to account number" (without revealing what the number actually is to the transaction processing server).

Re:not taking reasonable care

[Anonymous Coward]

Thank you Mr. Armchair Expert!

Re:not taking reasonable care

[mysidia]

If they locked the door but left open a window, I want to know. And I want to know how open that window was left.

Sometimes leaving the window ajar is a good idea, if you don't want the thief to smash the window on the way in.

Re:not taking reasonable care

[Anonymous Coward]

Sometimes leaving the window ajar is a good idea, if you don't want the thief to smash the window on the way in.

Nominated for this week's dumbest comment. A closed window is a deterrent. An open window is an invitation.

Re:not taking reasonable care

[cosm]

WHOOSH

Re:not taking reasonable care

[oztiks]

Yes and no. Being an Xbox Live player (hate to say this cause its MS we are talking about) but you can enjoy gaming without the posibility for account Hijacking. The only real problems Live has is people boosting the game.

PS on the otherhad, first off its a free service, 2nd it's continually having Script kiddes hack the game steal accounts. In fact I don't think I have ever met a single PS player that hasnt had their game hacked, messed with, or account stolen.

It seem's lose in the article (because there isn't anything definative suggesting it was done on purpose) but there is definatly plenty of malious activity taking place on PS network. This was bound to eventually happen.

Re:not taking reasonable care

[JDAustin]

When I had a convertable, I used to leave it unlocked. This way if they were going to break in, at least I wouldnt need to buy a new top.

Re:not taking reasonable care

[Anonymous Coward]

Smart man. I leave my car unlocked too so the crack-heads can just take the $1.27 from my ashtray and save me the trouble of buying a new car window every time I park out on the street.

Re:not taking reasonable care

[TheEyes]

The problem is that it is never a "well funded crime kingpin" and most often a 15-30 year old or an (ex) employee that noticed some gaping, obvious security flaw. Data breaches like this are rarely the work of huge "cyber gangs" and mostly the work of individuals who noticed some huge flaw that Sony had. The crime kingpins wouldn't bother with something like this because it is a whole lot easier to sell botnets with 3nl@rg3 y0ur p3n15 spam.

Twenty years ago you may have been right, but these days botnets are a multi-million dollar operation, underground black markets sell botnet time just like Amazon sells computer cycles, and cyber-gangs sell credit card numbers for a few dollars a pop. Cracking isn't the sole province of bored kids typing away from their parents' basement anymore; it's an industry, staffed by professionals.

Re:not taking reasonable care

[Anonymous Coward]

Whenever I open Windows I get hacked too. :/

Re:not taking reasonable care

[JMJimmy]

What's the problem with boosters? They usually stick to themselves and avoid randoms as much as possible...

Anyway, I hope one of these lawsuits hits Sony hard.

Re:not taking reasonable care

[DeadboltX]

When I ran a server that contained sensitive customer data, I left the database open and without a password. That way if someone was going to hack me, I didn't have to buy a new password. Analogy fail.

Re:not taking reasonable care

[oztiks]

Aside from the ethics behind boosting, nothing really. I agree with you on that Sony needs to be pulled into line regarding this. I know so many clueless 15 year olds that habitually steal PS accounts.

PCI isn't even going to come into play here which is quite astonishing. The upset consumer going for the cash grab wont be the issue. It will be Mastercard and Visa.

Re:not taking reasonable care

[errandum]

100%, no, but RSA with a long key is virtually uncrackable by today's standards.

I had a school project that deal with credit cards and the first thing we did was investigate encryption. AES, triple DES, RSA, even DES, anything is better than PLAIN TEXT.

Re:not taking reasonable care

[mug funky]

dammit, i need modpoints. the long weekend made mine expire.

Re:not taking reasonable care

[c0mpliant]

Passwords should not be stored either in an encrypted state or not, a one way hash value should be generated based on the password entered, this should be then salted and then that stored on the server. Then whenever the user logs in, the hash value of what they entered should be compared with the hash value thats stored and see if that matches. If it does then bobs your uncle, you are successfully logged in. I'm furious with Sony that they stored my password in manner which could be retrieved.

Re:not taking reasonable care

[johnsnails]

I think what he means is, what if someone was to torture Howard Stringer until he handed over passwords.

Re:not taking reasonable care

[Anonymous Coward]

Smart man. I leave my car unlocked too so the crack-heads can just take the $1.27 from my ashtray and save me the trouble of buying a new car window every time I park out on the street.

Problem here is, it wasn't Sony's $1.27 that was lost. It was my stuff lost, and 77 million other people..... The biggest problem of all is that Sony did not alert their customers in a timely manner. Fuck Sony.

Re:not taking reasonable care

[shermo]

That was the point wasn't it? Crime kingpins aren't bothering with this stuff because they're too busy expanding their botnets.

Re:not taking reasonable care

[Anonymous Coward]

I guess you missed the part where we were talking about servers.

Re:not taking reasonable care

[xero314]

Nominated for this week's dumbest comment. A closed window is a deterrent. An open window is an invitation.

This is incorrect. This is the same argument used to lull people into a false sense of security that is used to sell "The Club" for auto security. Back in the 90's I had a number of car stereos stolen, very high end equipment, highly prized by crooks. Both were stolen from fully secured vehicles. After the second one, I talked to the installer of the third, who also sold car alarms and other security devices. His advice was to leave the doors unlocked and have insurance. Breaking into a car, or a home, is very easy for even your average burglar . If you want to minimize your loss in the event of a burglary, then do yourself a favor and leave your doors and windows unlocked. People rarely walk from door to door looking for the easy target. What they do is scope out places that have easily fenceable goods and determine when the place will be empty. Then then enter the premises anyway they can, and smashing a windows is very, very simple.

Re:not taking reasonable care

[ghjm]

Well, storing the passwords in plaintext rather than hashed seems to me like a fundamental breach of any rational standard of care.

Re:not taking reasonable care

[errandum]

Obviously :P

I meant, if they are storing credit cards and personal data, some kind of encryption scheme is expected. Having it plain as day in a database is a big no-no.

Storing passwords in plain text is so amateurish that it hurts, although salting is a bit overrated... If they have access to your machine they know what salt you've done, leaving you vulnerable to brute force attacks.

Re:not taking reasonable care

[NemoinSpace]

maybe he's wardriving?

Re:not taking reasonable care

[fuzzyfuzzyfungus]

Ummm. Pay-per-view sensation?

Re:not taking reasonable care

[Nursie]

Good luck getting insurance companies to pay out if you left the car unlocked, though.

It may not be the way that a lot of thieves operate, but you can bet your arse that your insurer won't have a problem denying you a payout if you left your car unlocked.

Re:not taking reasonable care

[Nursie]

"salting is a bit overrated... If they have access to your machine they know what salt you've done, leaving you vulnerable to brute force attacks."

Sure, but it throws off rainbow tables nicely. Adding a little something into the mix that means any pre-computed list of hashes on the top billion or so obvious alphanumeric passwords is now useless, as we've stuffed in some binary crap. Brute force is now the only option, where before we could potentially break all the passwords using a single pre-executed brute-force dataset.

Salt is not an absolute protection. Like a lot of other things it just makes life more difficult and slower for the attacker.

Re:not taking reasonable care

[The Moof]

Being an Xbox Live player (hate to say this cause its MS we are talking about) but you can enjoy gaming without the posibility for account Hijacking.

That's actually not true. XBL support has a notoriously bad track record when it comes to social engineering and giving away your account details to attackers. There were quite a few articles about it a few years back (here's one from a quick search). I think it's actually more of a threat since a valid credit card is required for XBL Gold accounts.

Re:not taking reasonable care

[uofitorn]

Thanks Capt. Obvious. That's what he just said....

Re:not taking reasonable care

[MillerHighLife21]

It will answer questions, get a lot of press, make lawyers a lot of money and help those firms further advertise themselves for more lawsuits that the people affected will barely profit from, if at all.

Re:not taking reasonable care

[smash]

Good old Vlad the Impaler used to do this - deliberately leave gold items in the middle of town. Stealing was still punishable by impalement though. His crime rate was remarkably low.

Re:not taking reasonable care

[vegiVamp]

He has a point, though: leave the door ajar. It'll save you the cost of replacing a window *and* it saves on shark food for the tank under the trapdoor in the hallway.

What do you mean, you don't have a trapdoored shark tank as part of your alarm system ?

Re:not taking reasonable care

[vegiVamp]

> underground black markets sell botnet time just like Amazon sells computer cycles

One might even go so far as to think Amazon got the idea there.

Re:not taking reasonable care

[JMJimmy]

Very true. That and if they continue to lose these lawsuits and consumer protection board inquiries (Finland) it'll be death by 1000 cuts, or at least that's my hope.

on a side note: As a booster myself, I can honestly say the only reason I do it is because of the inability to find enough people to play most of my games (http://www.trueachievements.com/JMJimmy.htm). I've never needed to boost a Battlefield or Call of Duty but something like Dark Sector or Frontlines - absolutely. That or where the requirements are so ridiculous for an achievement that it becomes a time saving issue (Seriously in Gears, the fastest boosting method still takes 127 hours minimum, 1500 games in Fracture which no one plays - 30 hours minimum).

Re:not taking reasonable care

[DrXym]

if something goes wrong with their products, don't go public with it, don't acknowledge it, don't even think about it, and maybe it will go away!

By way of mitigation you might expect them to first assess what the damage was before coming out with a statement. It may have been annoying that they didn't come out and say straight off what was at risk but it's likely they didn't know themselves. The way I understand it was they detected an intrusion and spent the better part of a week figuring out how far the intruder got and what may have been exposed.

I think it would be in Sony's interests to set the record straight. It's not hard to find people screeching they didn't hash their passwords or encrypt the credit card info and a bunch of BS extrapolations which are all made in the absence of evidence. A technical summary might shut these voices down or at least focus on what Sony did or did not do right and serve as a good post mortem for other companies.

I also think as someone who has worked in an financial investments company that securing systems is not as easy as anyone here thinks. I doubt there are many systems in the world which are not vulnerable to intrusion. Indeed most companies anticipates it could happen. All code is security reviewed and run through tools like Fortify for the usual vectors like SQL injection attacks. Devs don't administer the production servers or have access to live data. Production servers have different keys to qa & dev. Independent teams manage single sign on. Independent teams do penetration testing. User facing web servers exist in a DMZ and have no direct access to databases. Firewalls separate web servers from web services from datbases. All comms are encrypted with 2 way ssl where appropriate. And so on. Defence in depth in other words. Even so it is no guarantee that a determined attacker, perhaps with inside knowledge couldn't break through and do some damage or steal sensitive info.

Re:not taking reasonable care

[DrXym]

I expect the first question an insurance company would ask in the event of a theft was "were your windows and doors locked?". It may even go further and they may require the locks to be certified to some national standard. And if you answer no then don't be surprised if you get nothing.

Perhaps the real solution is don't expose your very expensive stereo system where thieves can see it in your car. Invest in a hatch or cover where the system can reside without being visible. If thieves can't see the item they're trying to steal, the chances are they won't even bother breaking in in the first place.

Re:not taking reasonable care

[StripedCow]

Perhaps they designed it that way, but a programmer left a few debugging lines in the code...

Re:not taking reasonable care

[ciderbrew]

No. that is not all that was lost. That data get put towards another pile of data. Just because you can't think of how to use it, doesn't mean that someone else can't leverage it.

Re:not taking reasonable care

[mjwx]

The problem is that it is never a "well funded crime kingpin" and most often a 15-30 year old or an (ex) employee that noticed some gaping, obvious security flaw. Data breaches like this are rarely the work of huge "cyber gangs" and mostly the work of individuals who noticed some huge flaw that Sony had. The crime kingpins wouldn't bother with something like this because it is a whole lot easier to sell botnets with 3nl@rg3 y0ur p3n15 spam.

Twenty years ago you may have been right, but these days botnets are a multi-million dollar operation, underground black markets sell botnet time just like Amazon sells computer cycles, and cyber-gangs sell credit card numbers for a few dollars a pop. Cracking isn't the sole province of bored kids typing away from their parents' basement any more; it's an industry, staffed by professionals.

You are quite correct but the GP is still likely to be right about the cause. There is a big industry around cybercrime, sending spam, buying exploits and botnet time but the GP is right where they just dont target things like PSN because of the cost of the operation. It's cheaper to hire a botnet and send millions of C@n@d1@n P@rm@cy ads at everyone as the return on investment is much higher then going after a target with lots of money (ergo lots of security).

Exploits into big networks mostly come from disgruntled (ex)employees who are just as likely to use it for petty revenge as they are to sell it on the black market. Also employees are very vulnerable to social engineering, someone could have unwittingly given a third party access to the info they needed to find this exploit.

Second to that, individual or small groups of black hats also tend to be the ones that find the exploits and sell them, except they dont live in basements any more, they've got their own 2 by 4 McMansion.

Sony's corporate security will be going over every employee's file right now with a fine tooth comb.

Re:not taking reasonable care

[daid303]

Maybe this lawsuit will require them to come forward with the steps they *did* take. Up until now, it's largely been speculation. If they locked the door but left open a window, I want to know. And I want to know how open that window was left.

For starters, they transmitted CC numbers in plain text over the Internet.

I think, just pure speculation, that they stored all the details in a single database, and had an SQL Injection possibility somewhere.

Re:not taking reasonable care

[delinear]

There are still good and bad car analogies, though. If you wanted to make an analogy with one person's actions costing another person, how about: this is like the valet service that leaves my car unsecured because it saves them a few seconds when they go to fetch it, never mind that it's an open invitation to thieves (by the way, I'm not saying Sony did leave anything insecure, just trying to put the analogy back on track... oh, wait, that's trains).

Re:not taking reasonable care

[oobayly]

I tend to create a 4 byte salt for every record, that way a rainbow table has to be computed for every* record.

* Well, maybe not every one, but for 77 million records, you've a 1.8% chance of having duplicates (I think)

Re:not taking reasonable care

[delinear]

Agree with your main point - any system that relies on users with passwords is breakable by fooling the users - but just to point out the second point, regarding credit cards, is incorrect. You can buy a pre-paid Live Gold account subscription card (it's a scratch off the panel for a code deal, same as their "MS points" cards) and never have to register a credit card. I've had a Live sub since 2006, only used my credit card with it for the first time last year.

Re:not taking reasonable care

[CubicleView]

But if you get robbed you could just smash the window yourself, oh wait...

Re:not taking reasonable care

[errandum]

instead of using a complicated salting method, why not go with bcrypt? If you make it slow enough, it'll resist brute force and be virtually impossible to calculate a full rainbow table.

Re:not taking reasonable care

[Legion303]

"For starters, they transmitted CC numbers in plain text over the Internet."

No they didn't.

They transmitted CC numbers over SSL over the internet, and some dipshit reinvented the wheel and "discovered" that he could spoof a cert on his own system and decrypt his own data, then he started claiming the info was sent unencrypted, and people like you read the headlines and started making the same claim everywhere else.

Sony is an absolute shitfuck of a company (to coin a phrase), but you can't claim this one with a straight face.

Re:not taking reasonable care

[ZombieBraintrust]

Q: Was my personal data encrypted? A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/

Re:not taking reasonable care

[Muad'Dave]

Do what a friend of mine did back in high school. Sadly, this would be illegal today.

1) Get 20 large, insanely sharp fish hooks
2) Attach their eyelets together tightly with steel leader so that the hooks form a ball.
3) Place the ball-o-fishhooks under the dashboard where the thief will have to reach to disconnect wires.
4) Bolt the other end of steel leader to something very strong under the dash.
5) Place a towel on the carpet under the ball-o-fishhooks to catch the blood.
6) Call the cops if the thief doesn't get free, giggle a little if he does.
7) Replace towel.

Re:not taking reasonable care

[RobDude]

There wasn't any information that Sony had that wasn't publicly available at the local assessor's office....except my password and my credit card number.

Passwords should be unique, that's a non-issue.
Credit Card numbers are considered confidential; but they aren't *that* confidential. It's printed right on the card.

So yeah, it is largely a non-issue. And once the PSN is back up 99.9% of people will go back to using it exactly how they used to.

Re:not taking reasonable care

[erroneus]

If they were running windows, it's really a hard thing to close, lock or secure. I'd like to see someone get sued for running a Windows server. :) I'm sure a lot of people here would.

Re:not taking reasonable care

[erroneus]

Hahaha! I have a neighbor who still uses "the club" and it is clearly unlocked! She probably lost the key to it but she keeps putting the thing on her steering wheel thinking "oh no one will notice." She also has like three different security company stickers on her windows of her residence and what looks like an electronic door ringer sensor on the OUTSIDE of her door to show that she has security measures in place.

Yeah, it's all a deterrent ... for "some people...maybe." To me it just a big flashing sign that says "look at me! I'm paranoid, stupid and I think you're stupid too!"

Re:not taking reasonable care

[erroneus]

I still don't get why that is illegal or why a thief breaking into your home can win a lawsuit against you for leaving knives out in your kitchen!

Re:not taking reasonable care

[erroneus]

My sharks are currently being fitted with laser beams.

Re:not taking reasonable care

[Muad'Dave]

Even without obvious booby-traps, criminals have won lawsuits for falling down stairs and stepping on skateboards _in their victim's house_. How idiotic is that? In Virginia, I can shoot an armed intruder graveyard dead if my life's in danger, but if his life is in danger from his own clumsiness somehow I'm responsible???

Re:not taking reasonable care

[scot4875]

why a thief breaking into your home can win a lawsuit against you for leaving knives out in your kitchen!

Cite a source where this happened or I call bullshit.

And booby traps have been illegal for a *long* time.

--Jeremy

Re:not taking reasonable care

[Khyber]

"The only thing you lost was a week or two's worth of PSN service and the potential hassle of cancelling a credit card."

This is supposed to be a technically-minded board and you can't think of ONE SINGLE THING that could be done with SECURITY QUESTIONS THAT BANKS OFTEN USE and PERSONALLY IDENTIFYING INFORMATION?

Time for you to retire from the community.

Re:not taking reasonable care

[DrXym]

I'd love to know which bank you're even talking about. If your bank relies on stupid questions like "what is your maiden's name?" then I suggest you have larger issues to worry about than what happened in some online game service. Such details are easily discoverable which is why every bank I've dealt with will challenge me with a combination of account number, a password and usually a pin for good measure with potentially a hard token challenge too.

As for personally identifying information, you're talking about name, age, address, all of which is readily available from more or less anywhere. If that's all it took to steal someone's identity I could just trawl through Facebook, or the birthday classified, or listen to radio shout outs, or the numerous online credit report / background check services that yield that info and more for a small fee.

I think the data leak has been massively damaging for Sony but a little perspective would go a long way. It's a pain in the ass to be sure but hardly the end of the world.

Re:not taking reasonable care

[Khyber]

"I'd love to know which bank you're even talking about."

Wells Fargo, Union Bank, Bank of America, every single one, for the most part. I've held accounts with almost every major national bank.

Re:not taking reasonable care

[xero314]

And if you answer no then don't be surprised if you get nothing.

Insurance companies don't ask such questions, and they would need to have it in your agreement that it was a requirement if they wanted to deny your claim. They give you discounts for having alarm systems, they do not require that you secure the premises, at least not in any contract I have read.

Perhaps the real solution is don't expose your very expensive stereo system where thieves can see it in your car.

Thieves don't have to be able to see it. The purpose of high end stereo equipment is to be heard, and actually in many cases to be seen at shows and such. Yes it would be put in place so as to be obscure, but that really does defeat some of the point.

I was pretty happy with just taking the insurance approach. Theft claims do not typically raise your insurance rates, and when ever the equipment gets stolen I was able to use the insurance money to upgrade to the latest equipment. Never mind the fact that I believe that those who steal from me probably need it more than I do.

Re:not taking reasonable care

[praxis]

One should neither transmit from client to server a planitext password nor a salted and hashed password. It's better to send a nonce to the client and have it hashed with the salted hashed password client-side and send the hashed nonce back for comparison.

Re:not taking reasonable care

[powerlord]

Perhaps they designed it that way, but a programmer left a few debugging lines in the code...

or the system was exposed via a different vector since Sony's mentioned rebuilding the servers, which seems to imply that they were compromised.

Re:not taking reasonable care

[Firehed]

First, bcrypt requires a salt. Second, not everyone knows enough about security to do that (and not all of the cheap fly-by-night hosting solutions have the necessary extensions compiled - everything has md5/sha1), so I'd rather have a salted password and a crappy hash than nothing at all.

Either way, Sony should know better - as should any company with at least one salaried developer.

They sat on it for a week...

[Anonymous Coward]

So, they sat on it for a week...

And in the process, they are claiming that they do not have any reason to believe that Credit Card Information was actually accessed.

It seems as though the core concept of this case hinges on whether or not Credit Card numbers were actually accessed, which is something that Sony will definitely be going out of their way to hide, as it is grounds to show that all claims are ultimately invalid within this case.

In any case, there would need to be disclosed proof stating that not only Credit Card numbers *were* accessed, but that Sony *intentionally* went out of their way to hide this fact from their customers.

Seems flimsy at best.

Re:They sat on it for a week...

[Darkness404]

And sitting on something like this for a week -is- a problem. When you have possibly exposed the equivalent of 25% of the US population to credit card fraud, the world needs to know. This isn't some "oh whoops, one of our laptops is missing" instead this is a data breach affecting 77 million people. And to say -nothing- is completely irresponsible. A week is a pretty long time to not say -anything- and to just hope that it will go away.

Even someone who has your personal information for a few hours can cause havoc in your life, let alone for an entire week.

Re:They sat on it for a week...

[countertrolling]

...this is a data breach affecting 77 million people...

Yeah, isn't it exciting? And after it's all over they might win a Spiderman box set, or a ten dollar gift certificate, redeemable at the nearest Sony store. Winners are responsible for taxes and fees. Must be present to win. Void where prohibited by law.

Re:They sat on it for a week...

[Anonymous Coward]

However, according to PCI standards and requirements, if there is ANY breach of data, that could even slightly potentially contain payment card information, they have to notify immediately once they have knowledge of the breach. I would say its complete bullshit that they didn't know for a week there was a breach. I hope that Sony loses their ability to process payment cards for this, and that they do get their ass sued into a hole they can't recover from. I love my PS3, but this is just arrogance upon arrogance, and they deserve every ounce of what is forthcoming.

Re:They sat on it for a week...

[c0lo]

This is gross hyperbole. 77million accounts were compromised but that many people didn't have credit card information on there. A generous estimate would be 10% of accounts had CC information saved. Delusions of Grandeur

Attempts to estimate the impact:

Assuming a USD1000 in CC fraud for each CC: 10% x 77 mils x USD1000 = USD7700 - to be supported by either the owners of CC or CC companies;

Assuming a 10 mins per "support call" to change the card: 10% x 77 mils x 10 mins > 160.000 men*days.

Re:They sat on it for a week...

[Gandalf1957]

Actually compared to many others Sony's conduct in the matter is not at all bad. Plenty of financial institutions, including major banks have been compromised over the years and many have never admitted it even when 'outed'.

The network was almost certainly shut down the moment someone suspected something was amiss but it could easily have taken some time to identify what happened, what the extent of the damage was, notify the authorities and of course make attempts to trace the culprit.

It is also possible that once this became a criminal investigation Sony's subsequent actions were dictated to some degree by the investigating authority. It is standard practice in criminal investigation to restrict as much information as possible, even to those aggrieved and even a victim of a crime can be guilty of interfering with a criminal investigation if they don't comply with instructions.

Re:They sat on it for a week...

[qubezz]

The network was almost certainly shut down the moment someone suspected something was amiss.

Are you sure about this? How long between the Sony network operations discovering they were compromised to some executive with authority actually deciding the situation was dire enough to lose face and actually shut down the service for every PS3 user worldwide? Remember this is honor=deny Japan.

If you remember the early Sony disclosure (i.e. lies, now removed from the Sony blog): While we are investigating the cause of the Network outage, we wanted to alert you that it may be a full day or two before we're able to get the service completely back up and running. "Network outage", when they knew they had been rooted so bad they had to pull the plug??

Re:They sat on it for a week...

[thyrial]

The week was most likely for forensics. Once you've worked out somebody's in, there's not exactly the equivalent of a trail of breadcrumbs to tell where they've been. I don't envy their management, they get to work out which is worst: a) the hackers don't know they got somewhere sensitive, and you tell the world 'possibly' these details went missing, then when it's all back up the hackers try harder because they know where to look b) leave everybody hanging and worrying, but know for sure, be able to make a full announcement and deploy countermeasures.

I think they did the right thing in shutting off all access, but not giving a 'we are investigating the extent of....' was not so great. Ah well, just hope there isn't a next time.

My gut feeling is that the week was for legal dissection of "how the hell are we not going to get the pants sued off us over this" and working out the best PR spin, more than any technical or security work. But maybe I'm just a cynic...

Re:They sat on it for a week...

[Waccoon]

Maybe it's time for some credit card reform, too, so people would have more control over how personal information is used and partitioned in the first place.

Meanwhile, on planet Earth...

Class Action

[Anonymous Coward]

So, this will probably turn into a class action lawsuit in the coming weeks. Lawyers will get incredibly rich, and those affected with get a free PS3 wallpaper or something.

Re:Class Action

[tysonedwards]

Unfortunately, yesterday the Supreme Court ruled that one can not seek Class Action status for cases involving Products or Services.

See AT&T MOBILITY LLC v. CONCEPCION, Slip Opinion No. 09–893 (PDF)

Re:Class Action

[fermat1313]

Wow, I don't think you actually read that document. That opinion had absolutely nothing to do with Products or Services, and it doesn't disable class status for lawsuits. It states that an arbitration agreement that disallows class arbitration is allowable. Basically, if you sign away your right to arbitration by class action, that is valid, and you can't later invoke class-wide arbitration.

Lots of misinformation around here sometimes.

Re:Class Action

[TheEyes]

Unfortunately, yesterday the Supreme Court ruled that one can not seek Class Action status for cases involving Products or Services.
See AT&T MOBILITY LLC v. CONCEPCION, Slip Opinion No. 09–893 (PDF)

You think this is a bad thing?!

Hell yes it's a bad thing! When a large corporation can use a shrink-wrap EULA to force you into binding arbitration (read: a "court" they have literally bought and paid for), you will never again see that corporation bother with proper customer service. Remember, according to Sony you don't actually own your PS3; by signing up for the PSN, you are effectively renting that machine from Sony. From here on out, the customer is always wrong: our kangaroo court says so!

Re:Class Action

[olsmeister]

if you look at the document in TFA you will see that this is filed as a class action suit.

Re:Class Action

[h4rr4r]

Which means every contract consumers will deal with just had that clause added.

Re:Class Action

[shentino]

Not quite.

I just gave the decision a once over and it only states that binding arbitration clauses in agreements can bar class action claims.

You can still sue for tort or other claims that are not the subject of such agreement.

Re:Class Action

[zill]

Unfortunately, yesterday the Supreme Court ruled that one can not seek Class Action status for cases involving Products or Services. See AT&T MOBILITY LLC v. CONCEPCION, Slip Opinion No. 09–893 (PDF)

So that's why Sony waited a week...

Re:Class Action

[seanvaandering]

....which also means if that added clause is found to be illegal in your state, the above may not apply to you.

Re:Class Action

[Anonymous Coward]

Actually... what I believe the ruling was, was even if the state says that it's illegal, federal law trumps it.

Re:Class Action

[whisper_jeff]

Lots of misinformation around here sometimes.

Unfortunately, your use of the word "sometimes" was very generous and kind. And inaccurate...

Re:Class Action

[Khyber]

The right to a fair trial says you're completely fucking wrong regardless of what any bought-out Supreme Court fuckwit says.

He will have a hard time....

[mysidia]

Because of that, the complaint alleges, Sony did not allow its customers 'to make an informed decision as to whether to change credit card numbers, close the exposed accounts, check their credit reports, or take other mitigating actions.'"

Normally to sue a corporation over claimed negligence; you actually have to show that you were harmed.

Meaning, the plaintiff will probably have to show his inability to take mitigating actions due to Sony's negligence actually resulted in a loss or damages.

I suspect that will be difficult to pull off, unless his CC account was hacked / fraud was committed against him already as a result of the intrusion into Sony's network.

As for damages related to 'closing the account'.... if he were taking mitigating action, he would have to incur that loss regardless of whether Sony informed him earlier or not.

Now his bank and the payment card industry should be the ones taking the strongest stance against Sony; since it's the banks that most immediately bear the cost of fraud (due to policy of $0 liability for unauthorized account use; once the account owner identifies the transactions as fraudulent).

Re:He will have a hard time....

[ShiftyOne]

He will most likely try and get a settlement out of it before he has to show much damages. He should have went with the privacy route, it would be much easier to get a settlement, and you automatically get around $10 million without having to show harm.

Re:He will have a hard time....

[Fnord666]

Now his bank and the payment card industry should be the ones taking the strongest stance against Sony; since it's the banks that most immediately bear the cost of fraud (due to policy of $0 liability for unauthorized account use; once the account owner identifies the transactions as fraudulent).

The banks won't lose a cent. They will turn around and charge all of that fraud back to the merchants who accepted the charges.

Re:He will have a hard time....

[catmistake]

Private financial information was breached. That in itself is the harm, regardless of any credit theft subsequent to the breach. Even if Sony's network hadn't been breached, insecurely keeping financial records alone is in itself a harm to those individuals. Consider a bank that has never been robbed that keeps all its customers' money in piles in plain view in front of the bank. A customer could sue the bank for negligence even if there was no theft.

Re:He will have a hard time....

[Cederic]

How do you add a new charge to a credit card when you can't retrieve its number?

I fully expect that Amazon and Steam hold my credit card details in a retrievable form. I also fully expect that they encrypt those details, as they would not be PCI-DSS compliant if they don't.

It's still not a one-way hash.

Passwords being retrievable I completely agree is an utter fuck-up. Sensitive card details however are only as secure as the server they sit on, combined with the server their decryption key sits on.

Re:He will have a hard time....

[ZombieBraintrust]

Q: Was my personal data encrypted? A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/ It may be too early to file a lawsuit. He should of waited till actual damages occurred. I wouldn't be surprised if the passwords were also encrypted. Because such a scheme is week against a rainbow table attack. A good percentage of the 70 million accounts is going to have week passwords.

Re:He will have a hard time....

[nschubach]

Private financial information was breached.

Possibly, but not absolutely.

They've stated:

While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility.

The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

Re:He will have a hard time....

[geekoid]

A) Please, don't use the term very sophisticate to describe your security system that was breached form an exploit.
I mean, that's just funny. Also, we are defeating the Americans and driving them from our city.

B) They won't have evidence until they start to be used, or enough time goes buy.

C) Encryption isn't magic. I wan't to know what kind of encryption? These persons had complete access to the system, did they get the encryption key? Is the CC numbers sent to the CC company encrypted and then the CC company decrypt it?

D) They lost person information, and that in itself is harm.

Re:He will have a hard time....

[Kalriath]

Unless the merchant has 3DS enabled. 3DS includes a liability shift back onto the issuing banks in cases of "Unauthorised Purchase" chargebacks.

Re:He will have a hard time....

[ZombieBraintrust]

It now appears the credit card data was encrypted and the passwords stored using using a cryptographic hash function. They did some of the proper precautions to secure the data.

He got notified?

[FSWKU]

I still have yet to hear a single word out of Sony. Had I not seen the Playstation Blog post, I would have known NOTHING about the severity of this issue until it hit all the major news outlets.

Sadly, I know how this is going to turn out. There will be a class-action suit in which Sony is fined heavily. But the vast majority of the money will go to some shark lawyer, and the only thing the people affected by this will receive is a free 1-month subscription to PSN+. Actually, I'll be surprised if they even give us that much.

If this DOES go class-action, I will definitely be on the lookout for my notice to opt out. If I see any erroneous charges on my card stemming from this massive amount of incompetence, I want to retain my full legal right to bring my own suit against Sony where they will be required to provide me with credit monitoring and credit fraud protection. I'm sorry, but a boilerplate "we're sorry" and some token gesture are NOT going to cut it here.

Re:He got notified?

[Labcoat Samurai]

I still have yet to hear a single word out of Sony. Had I not seen the Playstation Blog post, I would have known NOTHING about the severity of this issue until it hit all the major news outlets.

Indeed. On the blog, I noticed some apologist in the comment section trying to defend Sony by saying that it takes a long time to send 77 million emails. Tell that to a spammer, I thought.

Re:He got notified?

[Bios_Hakr]

Definitely. I'd love to see Sony deal with 77M suits in small-claims court.

At $500 per suit, that would be something like $38B.

Re:He got notified?

[FSWKU]

Don't forget the legal fees incurred (both from Sony's lawyers AND having to pay the legal fees for every claim they lose).

Re:He got notified?

[FSWKU]

But are arbitration clauses even valid in cases of gross negligence and witholding vital information needed to prevent financial damages?

Re:He got notified?

[Bios_Hakr]

It *needs* to happen. And happen big. Maybe after Sony files for bankruptcy, investors in other companies will start asking the CIO to ensure security at any cost.

Re:He got notified?

[Destoo]

I've just received my notice. What took time was the translation/localization to french, probably.

It's still unacceptable, but at least I received it.

Re:He got notified?

[Nerdfest]

Isn't that effectively what they did to Lik Sang?

Re:He got notified?

[h4rr4r]

Thats the risk the investors took. Don't like? Invest in more reputable companies.

Re:He got notified?

[Missing.Matter]

Check your inbox. My friend literally just got an e-mail from Sony about this.

Re:He got notified?

[Anonymous Coward]

3 minutes after parent posted, I received an email from sony. Just thought I'd like to state that for the record.

Re:He got notified?

[FSWKU]

I just now got the notification in my email (literally about 30 seconds ago). This was on the Playstation Blog WELL over 24 hours ago, and I'm only just now getting a notification (which states the exact same thing). There is no excuse for taking this long.

Re:He got notified?

[interkin3tic]

Don't want to lose money as an investor? Sell you shares for this shitty corporation. Don't want to lose your job? Don't work for corporate douche-bags with shitty ethics. Shit's simple, huh? ;)

I'd say simplistic, not simple. What does the guy putting together headphones know whether or not the PSN security guys are hashing the passwords? I don't really understand it, and I'm here. With a corporation even a tenth of the size of sony, it's unlikely that every employee and investor to know what liabilities every other employee is or is not opening the company up to and thereby risking their jobs.

It's not like these guys were working for "Child molesting inc," the ethic violations here, if any, were not so obvious that "they should have known better."

We can't keep allowing these huge corporations to do whatever they want at our expense. Then using the excuse of "investors and employees" as a reason to turn a blind eye to this kind of things.

I'm not suggesting anything like that. Holding the executives liable is the one and only way to effectively regulate this. They're the individuals who made the relevant decisions, they're the ones who need to be held accountable for those bad decisions. The executives who let this happen are the ones who should be sued.

Re:He got notified?

[interkin3tic]

Sony cut corners -- some executive decided NOT to invest in proper security measures

Then sue the executives.

You realize that Sony's _ENTIRE_ gaming division operates at a NET LOSS, right?

Gee, how did I miss that in school?

Sony makes its money in the FINANCIAL SECTOR and subsidizes its gaming business. This lawsuit (even if it's in the billions) will NOT bring Sony down. So some research about the background of the company, before posting BS like this again... Thanks.

I'm not sure how "Sony's gaming division loses money all the time" translates into "Sony's gaming division losing billions more than usual cannot possibly harm the rest of sony."

By the way, relax a little. Why are you that upset about someone being ignorant of the intricacies of Sony's corporate structure?

Re:He got notified?

[MightyMartian]

Dear Mr. Anonymous Coward,

We at Sony are deeply sorry for the worry and risk to your financial security we have caused. We are committed to fix our errors and making financial settlements. Please click on the link below and provide your bank account number so that we may deposit the amount of $11,000.

http://stupidpsnusers.russianmafia.ru/stealyourbankinginfo.php

Re:He got notified?

[c_jonescc]

Maybe it's possible to work in one division of a major corporation and have no idea what the other divisions are doing. If so, my money's on the fact that the corporate legal team has made it such that separate divisions are indeed separate entities, and gross failure on the games division won't destroy the foundations of the other divisions.

If you're company is not that big, take a clue from the corporate culture which is usually used to sell a potential employee - "we're sure you'll love it here, as our culture is such that mostly like minded people work here, and you're sure to get along with your co-workers". Does your division do things that are wrong? Then it's likely they all do. So, there's that for the 'poor employees' excuse.

Investors are crap. Look at mutual funds. Do you have qualms about investing in something that has ties to modern pseudo-slavery or insane environmental malfeasance in the third world? Try to find a fund that excludes those potentials. Then you'll find the ethical funds that return a FRACTION of the others. Investors are trying to turn a buck, which is fair, but it's also fair if they lose money because no investment is guaranteed. Want investors to stop turning a blind eye as long as the returns are high? Then make sure they pay their share when the returns were earned through shitty practices.

That said, I agree with what you say about the executives. They need to be punished for their decisions and not paid off with disregard to their ethics.

Re:He got notified?

[c_jonescc]

Never heard of that, but am compelled. Perhaps AC will return and tell us who he banks with, please?

Re:He got notified?

[jschottm]

investors in other companies will start asking the CIO to ensure security at any cost

Really? Any cost? There is no such thing as a completely secure network or computer (that provides a usable amount of capability) and getting to a high level can be very, very expensive. Are you willing to give up e-commerce? The ability to get government services online? Your gmail accounts? (Google, after all, quite publicly got hacked, yet you continue to use them.)

Are you prepared to pay three, four, five, ten times as much for your phone and network connections?

This is a major leak of personal information but it's nothing that should bankrupt a major corporation based on what's known now. The big reform that needs to happen is that identity fraud needs to get harder to do based on simple information like names, address, and DOB, significant amounts of which can already be found in public records.

Re:He got notified?

[countertrolling]

Name one... If there ever was a business where nice guys finish last, this would be it.

Re:He got notified?

[x1r8a3k]

I got an email earlier today. It was mostly a verbatim copy of the recent announcement, but actually had details about the applicable laws in my state regarding identity theft and protections, credit freezes, etc. They might not have finished one for your area yet.

Re:He got notified?

[pdabbadabba]

Apparently that doesn't take as long as the U.S. localization and translation into English required for mine, which has still not materialized.

Re:He got notified?

[schnell]

Maybe it's possible to work in one division of a major corporation and have no idea what the other divisions are doing.

MAYBE it's possible? My friend, you have clearly never worked at even a mid-sized company, let alone a big one.

My previous employer had about 200 employees scattered across three cities. People in my department had never met and had absolutely no idea who various other employees were or what they were doing, let alone having any authority over the choices they made. Now I work for a company that has more employees than there are residents in the city of Madison, Wisconsin. I have no more knowledge of what all my fellow employees do than one resident of Madison knows what every single other person in the city is doing.

Think about it - even at a comparatively tiny 200 person company, if the accountants decide to cheat on the company's taxes, what is the likelihood that the engineers, IT staff, sales guys, receptionists or customer care reps know? And why should they? It would be crazy for any company to ask the IT help desk to review the work and policies of the accountants, or vice versa.

Let's say that company X is cheating on its taxes... it may be only 10 people (or even just a couple like the controller and CFO) who did anything wrong. But by your logic the other 190+ people are responsible when they had neither knowledge or influence. It's like saying the residents of New York City are responsible for some dumb "intelligent design" law in the state of Texas because "they're all Americans."

So it may be very comforting when you want to blame someone to say "employees of X are scum" or are all responsible for some element of malfeasance, but unfortunately it's an overly simplistic and very naive view. Let's hold the comparatively small group of executives responsible for these decisions personally and professionally accountable and keep the blame where it belongs.

Re:He got notified?

[mywhitewolf]

Regardless of who you attempt to hold accountable, when the payouts are coming from the company the employees will always lose to some degree. yet people get fired all the time for things that aren't their fault because its in "the best interest of the company", we can't protect a dodgy company because it will cause some sort of unemployment. would we not send a father of 3 to jail for fraud just because his family survive of his ill gotten gains? why make that exception for a company?

Re:He got notified?

[MimeticLie]

Not the AC, but I know Bank of America does it. I'm sure there are others.

Re:He got notified?

[sjames]

Hello, this is Somy Nigerian ofice. Please provide us with your banking details so you can receive you compensation. Don't beliv other claims we're the reel somy.

Re:He got notified?

[vegiVamp]

Heh. Just got the Dutch notification, too. It says data was 'compressed' and more crap like that. Seems they can't even be bothered to get proper translators.

Re:He got notified?

[GNious]

I got notified a couple of hours ago - in an email with a link to sign into PSN to change my details. Oddly enough, the link didn't work.....

Re:He got notified?

[ZerothAngel]

Not the AC either, but Citibank offers such a service. I've used it a few times for those random one-off purchases, especially from stores I will probably never do business with again.

Though, it's probably not very useful for subscription-type services or places you do business with regularly. (Unless you really want to generate a new CC number for each order.) I guess the previous poster's suggestion of having a low-limit card would be helpful in that case, something I plan to look into for myself.

Re:He got notified?

[AmiMoJo]

So how come you could claim $500? In the UK you can only claim for losses you suffered, so I suppose most of your claim would be punitive since a few weeks without PSN isn't causing you an financial hardship.

How does it work in the US? How is the level of punishment decided?

Re:He got notified?

[SJ]

When was the last time Visa was hacked? (Their payment processing system, not their web site)...

Or MasterCard for that matter...

Systems CAN be built to be very secure. Most companies just don't want to.

Re:He got notified?

[FictionPimp]

Not the AC, but here was my email

Valued PlayStation(R)Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011,
certain PlayStation Network and Qriocity service user account
information was compromised in connection with an illegal and
unauthorized intrusion into our network. In response to this
intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full
and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our
network infrastructure by rebuilding our system to provide you
with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill
as we do whatever it takes to resolve these issues as quickly and
efficiently as practicable.

Although we are still investigating the details of this incident,
we believe that an unauthorized person has obtained the following
information that you provided: name, address (city, state, zip), country,
email address, birthdate, PlayStation Network/Qriocity password and login,
and handle/PSN online ID. It is also possible that your profile data,
including purchase history and billing address (city, state, zip),
and your PlayStation Network/Qriocity password security answers may
have been obtained. If you have authorized a sub-account for your
dependent, the same data with respect to your dependent may have
been obtained. While there is no evidence at this time that credit
card data was taken, we cannot rule out the possibility. If you have
provided your credit card data through PlayStation Network or Qriocity,
out of an abundance of caution we are advising you that your credit
card number (excluding security code) and expiration date may have
been obtained.

For your security, we encourage you to be especially aware of email,
telephone and postal mail scams that ask for personal or sensitive
information. Sony will not contact you in any way, including by email,
asking for your credit card number, social security number or other
personally identifiable information. If you are asked for this information,
you can be confident Sony is not the entity asking. When the PlayStation
Network and Qriocity services are fully restored, we strongly recommend that
you log on and change your password. Additionally, if you use your PlayStation
Network or Qriocity user name or password for other unrelated services or
accounts, we strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss, we
encourage you to remain vigilant, to review your account statements and
to monitor your credit reports. We are providing the following information
for those who wish to consider it:
- U.S. residents are entitled under U.S. law to one free credit report annually
from each of the three major credit bureaus. To order your free credit report,
visit www.annualcreditreport.com or call toll-free (877) 322-8228.

- We have also provided names and contact information for the three major U.S.
credit bureaus below. At no charge, U.S. residents can have these credit bureaus
place a "fraud alert" on your file that alerts creditors to take additional steps
to verify your identity prior to granting credit in your name. This service can
make it more difficult for someone to get credit in your name. Note, however,
that because it tells creditors to follow certain procedures to protect you,
it also may delay your ability to obtain credit while the agency verifies your
identity. As soon as one credit bureau confirms your fraud alert, the others
are notified to place fraud alerts on your file. Should you wish to place a
fraud alert, or should you have any questions regarding your credit report,
please contact any one of the agencies listed below:

Ex

Re:He got notified?

[delinear]

It's also missing the much bigger picture, namely someone will pay for this. Sure, the employee mopping floors didn't know what was happening, but does that somehow make it fairer to push the responsibility onto the customer who bought in good faith? Or onto the poor retailers who are going to get scammed and chargebacks from the credit card companies? If anyone has to pay it should be the company that was in a position to do something about it, not a bunch of third parties who didn't have that option - sure it sucks for the non-related employees but it's still the fairest of the alternatives.

Re:He got notified?

[delinear]

Besides, maybe if employees were at the sharp end they would speak up about indiscretions in their own departments. I'd be surprised if this was caused by some incompetency in the company's IT department, more likely it was caused by cutting corners. If employees knew their jobs were on the line because some bean counter further up the chain was making "efficiency gains", more people might speak out when they witness negligent practices.

Re:He got notified?

[uncledrax]

"Maybe after the smaller Sony parented corporation that runs PSN files for bankruptcy, investors in other companies will start asking the CIO to ensure security at any cost."

Fixed that for you.
Lets be real, no single lawsuit of this nature would even come close to toppling something like Sony (from just the lawsuit.. it's possible it might negatively affect sales down the road.. but there will still be tons of people that buy Sony products regardless of what happens with the current PSN/breach thing)

Re:He got notified?

[L4t3r4lu5]

Sadly, I know how this is going to turn out. There will be a class-action suit in which Sony is fined heavily. But the vast majority of the money will go to some shark lawyer, and the only thing the people affected by this will receive is a free 1-month subscription to PSN+. Actually, I'll be surprised if they even give us that much.

So don't join the class action. File a suit in small claims court. As some fellow said below, at $500 fine / damages per suit, that's close to $38b. Even if you only get $50 per suit, that's their operating income for a decade down the swannie.

Re:He got notified?

[gravis777]

I'll wait until after a few people have won against them before I make a lawsuit. If I wait enough, I may not have to have to pay a lawyer

Re:He got notified?

[gravis777]

Nothing in my inbox.

Re:He got notified?

[uncledrax]

(IANAL)
I'd guess this would become a class action suit .. and assuming it is judged against Sony, the actual awarded damages to plaintiffs would end up being pretty small.. I'd guess sub-$100USD/person [to cover things like 'loss of functionality to the network' and covering additional credit monitoring products.. etc..].. there could be additional assessed penalties/fines based on the findings of the court, and of course the lawyers will probably be able to retire afterwards.

Re:He got notified?

[delinear]

What you need is the ability to tie a number to a specific retailer to make multiple purchases with that retailer, but that would be useless with any other retailer. You'd still be open to fraud if someone used your card to make purchases with that one retailer, but it would mitigate potential for fraud to some extent. I wish credit card companies were doing more to give us the tools to make ourselves more secure - I couldn't even find a card (that I'd heard of) that offered the one time use feature when I was shopping around last year (in the UK). I guess they have it set up pretty nicely to shift the onus onto the retailers if there is a fraud, so they probably figure why waste the money offering these features, if it costs our customers X amount of time and hassle to sort things out, well, what are they going to do - go somewhere else for the same level of service?

Re:He got notified?

[Israfels]

I'm sure most people don't mind occasional outages. In this situation, however, you're paying for many services linked to a PSN account and not only are you not getting the service promised, but they're hiding the fact that your personal information has been compromised. This is a step below bait and switch. instead of a lower quality service, they're providing an unservice. Deliberately hiding knowledge of the loss of private data for this long is at the LEAST a fine.

Losses suffered don't have to be financial. The loss of security can be costly. In this day in age when identify theft can wreak havoc, having personal information floating around the internet can be difficult and expensive to monitor and defend against. The damage is the loss of a secure identity, at a minimum.

I don't have a PSN account, I'm just following this story out of interest in security practices.

Re:He got notified?

[Kielistic]

If we stopped rewarding this behavior with "We can't punish them! Investors!" maybe there'd be some more reputable companies.

You are right that cheating makes more money. But if people don't invest in cheating companies because it's a bad investment well then those companies won't make it too far will they?

Re:He got notified?

[Bios_Hakr]

You could claim that you suffered a loss by having to check your CC statement daily for a month, then weekly for a year.

Claim the time spent on the phone with the CC company to get a new card issued.

Claim the time you spent between when the old card was axed and the new card arrived.

Claim the increase in SPAM via email and snail mail.

Re:He got notified?

[AmiMoJo]

*notes down list for future reference*

Re:He got notified?

[h4rr4r]

The point is if the investors suffer the companies are encouraged to act in a more correct manner. If we never punish them for this, then no one ever learns.

Re:He got notified?

[geekoid]

They ALREADY provide you with credit monitoring, and free fraud alert:

http://us.playstation.com/support/answer/index.htm?a_id=2185

Sony was slow to respond, slow to inform consumers and failed to maintain security of the system.

However, they aren't being complete idiots about it.

Re:He got notified?

[Gojira Shipi-Taro]

They're not providing anything. That "annualcreditreport" link is an existing legal obligation on the reporting agencies imposed by the US govermnent. Sony did nothing apart from provide a list of affected persons to the credit agencies.

Re:He got notified?

[Khyber]

"If there ever was a business where nice guys finish last, this would be it."

Try my industry sometime, where 99% of the stores are simply resellers selling a ton of lies, perform no meaningful research, and use wikipedia's incomplete and (usually) inaccurate articles as 'reliable sources' or 'research' without having ever touched an actual plant.

Seriously, it's tough having to dispel the sheer amount of bullshit that has been introduced to the world of horticulture thanks to (primarily) misinformation on cannabis websites.

Re:He got notified?

[Khyber]

"In the UK you can only claim for losses you suffered"

Not in cases of violation of the UK Data Protection Act

Re:He got notified?

[powerlord]

Isn't that one of the reasons Class Action Lawsuits exist?

Ugghh!

[Chubcorp]

It takes time to find out what has been compromised. The hacker won't just come out and say "All your base are belong to us" Sony told us when they found out. If they did say that there is a possibility on day one that it may be compromised then there would be a lot of hectic and closing bank accounts on an hunch. If nothing had been compromised and they told us it may be (on day one) then people would be mad and still sued Sony for misleading them. Crap happens, suing doesn't make it better. Plus nobody said you had to create an account, nor did you pay for it.

Here's to sinking Sony's battleship

[cultiv8]

46 DC EA D3 17 FE 45 D8 09 23 EB 97 E4 95 64 10 D4

Re:Here's to sinking Sony's battleship

[Anonymous Coward]

That's not quite the whole key.

46 DC EA D3 17 FE 45 D8 09 23 EB 97 E4 95 64 10 D4 CD B2 C2

Re:Here's to sinking Sony's battleship

[shish]

If those are the grid references for the different pieces of Sony's battleship, I'm surprised it can float in the first place o_O

Re:Here's to sinking Sony's battleship

[froggymana]

46 DC EA D3 17 FE 45 D8 09 23 EB 97 E4 95 64 10 D4

Hey! Thats the password I used for my PSN account!

Re:Here's to sinking Sony's battleship

[vegiVamp]

Given the depth of their legal coffers, I'd say it's more likely to be a floating fortress, yes. Those are just the coordinates to the thermal exhausts.

Re:Here's to sinking Sony's battleship

[marcansoft]

Mod parent down for perpetuating a useless, incorrect key that just won't die.

That's the USB dongle service mode authentication key, which is useless for breaking PS3 security except as an accessory to some now-disabled functionality that requires leaked service executables. In other words, it's 1) impossible to use legally, as you need to infringe copyright to use it, 2) useless since a few updates ago, 3) won't help you break into lv2, 4) won't help you break into the security system, 5) won't help you break the chain of trust, 6) won't help you run Linux.

It was only ever used as part of a commercialy distributed firmware downgrade trick designed for a commercially distributed piracy tool.

Now can we please switch over to a relevant string of hex digits when talking about PS3 security? Please? I suggest "Da" from geohot's keydump, which is the metldr private key, and infinitely more relevant than this 46 DC nonsense.

Re:Here's to sinking Sony's battleship

[ZombieBraintrust]

You joke but it kind of was in the end.

Re:Here's to sinking Sony's battleship

[geekoid]

uh, NO.

It was way easily recognizable way to deliver a joke.

Which is a form of humor. You might want to look into it.

Then there was the Kevin Butler incident, as well as Sony getting punk'd with it.

I mean, just paste it into google, and see how wide spread it is.

Yes, it was only used to jailbreak and play homebrew games.

DRM anyone?

[lasinge]

It's funny how Sony works so hard to protect their data and content via all their DRM attempts, when it's their customer's - not so much. On the other hand, they now have something to point to when people want to run whatever OS they want to run on their machines. Still, they can't stop it, they should focus on keeping their customer's credit card info out of harm's way (remind me why they need to keep persistent credit card data anyway? That should be an opt in only type of thing, with a required expiration date otherwise.) On a related note, when I set up a new account at my bank they only allow alpha-numerics with no special characters. WTF? Try to explain rainbow tables to a bank representative. So I used all of them ... I had the longest password she had ever seen.

Re:DRM anyone?

[Sinthet]

Storing credit-card numbers == potential cash for Sony. Ethically, I agree it should be an opt in type of thing, but by making it automatic, I'm assuming (I don't own a PS3) that people can automatically buy content, which they're probably much more likely to do when they dont need to get up off the couch to get their credit card.

Re:DRM anyone?

[shermo]

...dont need to get up off the couch to get their credit card

Doesn't everyone here remember their credit card number anyway? It's 2 phone numbers. I guess if you have multiple credit cards it could be an issue, but doing so must have saved me literally tens of minutes.

Re:DRM anyone?

[vegiVamp]

Not exactly. Your card is stored, so the PS3's master account holder doesn't need to get off his arse to top up the PS3 points wallet. Once that walled is topped, all of the system's users can buy content.

Topping up the wallet isn't automatical. You need the master account password to do it.

Re:DRM anyone?

[mjwx]

It's funny how Sony works so hard to protect their data and content via all their DRM attempts, when it's their customer's - not so much.

More ironic then funny,

Ironic that their attempts at protecting customer data have been as successful as their DRM.

Re:DRM anyone?

[delinear]

Ugh, I hate that - besides I'm always dubious when special characters aren't allowed in passwords. If they're hashing it, it shouldn't matter to them what characters I use, so it always makes me wonder why they'd have such a policy unless they're storing it plain text and don't want to worry about sanitising little Bobby Tables. I hope your password was along the lines of: y0urCr4ppyP4ssw0rdSyst3mThr34t3n5MyS3cur1ty

Re:DRM anyone?

[I'm not really here]

Seriously. I'm leaving my bank because their password policy is:

Alpha and Numeric values only, no punctuation, no special characters. Minimum length: 6 characters. Maximum length: 8 characters.

I explained to their security department how ridiculous this was, and that a password like that is inherently highly insecure, detailed all the reasons, explained that I use passwords that are full sentences with punctuation and a few special characters peppered throughout... their answer? Sorry, allowing longer passwords leads to more requests for password resets.

Convenience for the bank support desk was ranked more important than my ability to secure my financial data. Yep... looking for a better bank.

Re:DRM anyone?

[houghi]

remind me why they need to keep persistent credit card data anyway? That should be an opt in only type of thing, with a required expiration date otherwise.

The only reason is so they can easily charge you without you having the need to click OK. Because that could mean that you won't click OK the next time.

Opt in? That would mean trying to transfer the blame to the customer.

There is absolutely no need to keep the credit card number and in some countries it is even forbidden.

How things should work:
1) Customer types in credit card stuff.
2) Company asks CC Company if payment for XY amount is autorized.
3) CC Company says yes and gives a reference number
4) Company forgets the number, except the last four and combines this with the name of the customer, time it was done, IP adress, email adress and reference number.

That will be enough to identify the customer if he complains. If the card was not called in as stolen he has to pay. If he didn't, he is responsible for it.

But then in Europe it is pretty common NEVER to give your card to anybody else, including waiters. They will come with the machine, put it in the machine that reads the chip card. In the US often the magnetic strip is the one that is used.

Re:DRM anyone?

[lasinge]

Opt in? That would mean trying to transfer the blame to the customer.

I hadn't looked at it that way, I suppose a lawyer would argue that. So the question is how do we push for laws that make it illegal to persistently store CC info, I am guessing this case will affect a lot of people and as the CC companies are the ones who end up footing the bill for fraud, it should benefit them as well.

Re:DRM anyone?

[lasinge]

ummmm, no.

Re:DRM anyone?

[lasinge]

pretty much, except in a different order.

Re:DRM anyone?

[lasinge]

Thanks for that, seriously I wouldn't have thought that. What are you defining as "special characters"? I'm not sure if I follow your equations either, forgive me for being daft I honestly want to know.

Well...

[Anonymous Coward]

Actually I just got a notifaction from Sony abou this today.
And According to this http://vgn365.com/2011/04/26/psn-users-reporting-hundred-of-dollars-stolen-from-them/
The CC's are already in the wild.
I know Visa is aware of the issue. They have reissued me a new card based on this information.
So yea it could go somewere

Re:Well...

[master811]

Actually I just got a notifaction from Sony abou this today.
And According to this http://vgn365.com/2011/04/26/psn-users-reporting-hundred-of-dollars-stolen-from-them/
The CC's are already in the wild.
I know Visa is aware of the issue. They have reissued me a new card based on this information.
So yea it could go somewere

And yet you believe this? There is no proof and according to Sony all CC data was encrypted. For all we know it's simply a troll trying to stir up trouble.

http://blog.eu.playstation.com/2011/04/28/playstation-network-and-qriocity-outage-faq

Re:Well...

[Cederic]

VISA don't issue credit cards.

Not to mention that the set of "PSN users" and the set of "People whose credit cards have been fraudulently charged" were never mutually exclusive, so PSN users suffering card fraud is not itself an indication that the PSN compromise led to that fraud.

Of course, sensible people with either cancel their card or at least closely monitor their statements for a few years. But sensible people monitor their card statements anyway..

Re:Well...

[master811]

Actually VISA do issue credit cards, not directly of course, but through other banks etc. Although, I still find it unlikely that these 2 people have actually lost money because of this.

Re:Well...

[Khyber]

I'll believe it, my fiance is missing a bunch of money suddenly from his own bank account. Yesterday direct deposit of paycheck. Today, more than half of that is suddenly missing with the bank (Wells Fargo) calling us to confirm all of these wild transactions are legitimate.

Is a lawsuit necessary at this stage?

[joeflies]

So he's after recovery of damages, but so far it doesn't indicate that he's experienced fraud, and it's not going to come out of his pocket anyways (the credit card company would handle any fraudulent charges).

He also wants credit card monitoring services, but it's not exactly clear that Sony would not have offered such services. It sounds like they're still investigating the extent of the breach. By making it part of the lawsuit, just how long will it take to get the services? After the lawsuit has been settled several months from now? I'd bet that he'd get the services a lot sooner through public pressure than as a remedy of a lawsuit.

Which leaves the third part of what he seeks - recovery of lawyer fees. Now it's pretty clear why this lawsuit exists at this stage - the opportunity for the lawyers to get rich in the name of consumer protection.

Re:Is a lawsuit necessary at this stage?

[MightyMartian]

And your credit card has been used to launder money by buying child porn and the FBI is about to knock on your door and destroy your life.

Re:And he is an affected party how

[tysonedwards]

Well, you could always argue that being without your credit card for a week while waiting on your bank to issue another one is "damaging" to one's quality of life.

If they need to take time out of their day to go to the bank to get cash from a human, the additional time spent conducting cash transactions versus the use of cards, the time to get your accounts updated to use the new Card Number to prevent your power from being shut off, and so on, then "damages" can actually be shown.

Not much different from the random times when your wallet is stolen.

Ooops

[M0j0_j0j0]

They really messed up this time! life is a bitch aint it?

Check your EULA... you probably can't sue

[artor3]

Our wonderful, conservative-activist Supreme Court just ruled today that any company may stick a line in their EULA stating that by using their product, you forfeit the right to sue, and must instead use a private arbiter of the corporation's choice. They based this decision on a 90 year old law that was written to cover maritime shipping disputes.

Of course, since most contracts these days state that the corporation has the right to change the terms at any time without notice, this basically means that you can no longer sue a company that you've entered into a contract with.

Still think you have rights? Not as long as a Republican holds office!

Re:Check your EULA... you probably can't sue

[artor3]

Keep telling yourself that. The Supremes just ruled otherwise, and their opinion is the one that counts.

Re:Check your EULA... you probably can't sue

[fermat1313]

Um, you completely don't understand this. Arbitration is a long-standing method of settling a dispute between parties. It is extremely common in Professional Services engagement agreements, and it is also very common in other service agreements. I'm quite sure almost every agreement you sign for internet, phone, electricity, cable TV, etc also includes arbitration language.

Arbitration is a good thing. It allows small matters to be handled quickly, less expensively, and without mucking up our already congested court system. If you read the opinion, the court indicate that AT&T's arbitration agreement is specifically written to encourage the company to act in good faith. If a customer receives an arbitration award greater than the last written settlement offer, the customer gets $7,500 + twice any lawyer's fees. Clearly, AT&T has incentive to provide a good settlement. In this case, AT&T would have offered the plaintiffs $30.22, which is what the plaintiffs were (perhaps) wrongly charged in sales tax. Any decent arbitrator would have given the plaintiffs $30.22, which is what they were their real loss. Trust me, arbitration agreements are a good thing. Our court system would be practically non-functional without them.

Re:Check your EULA... you probably can't sue

[lenroc]

Our wonderful, conservative-activist Supreme Court just ruled today that any company may stick a line in their EULA stating that by using their product, you forfeit the right to sue, and must instead use a private arbiter of the corporation's choice.

Not true, actually. They ruled that customers that have signed a contract with a clause to that effect are bound to it. AFAIK, there is no settled case law saying that a shrinkwrap EULA is equivalent to a valid, signed contract.

Re:Check your EULA... you probably can't sue

[xMrFishx]

EULAs don't trump consumer laws, especially in europe. You don't have a signature on a EULA, they don't mean jack shit over here. The ICO (information comissioner's office) - responsible for the data protection laws in the UK is already looking into this.

Re:Check your EULA... you probably can't sue

[bobstreo]

I did not accept the EULA.

Any lawyers want to represent?

Re:Check your EULA... you probably can't sue

[PRMan]

Techdirt just found that 96% of awards in business vs consumer arbitration go to the business. Still stand by your statement?

Re:Check your EULA... you probably can't sue

[raehl]

If by "go to the business" you mean the customer was charged $30.22 extra, and the business offered $30.22 credit, and the customer wanted arbitration, and the arbitrator decided on $30.22, then yes, I stand by his statement.

Re:Check your EULA... you probably can't sue

[cptdondo]

Arbitration works well between equals, or those who have equal exposure, and in highly technical disputes like proifessional services where a jury of one's peers would be hard to find.

That relationship does not hold for an individual customer against a company that is larger than most nations, and controls vast resources.

Re:Check your EULA... you probably can't sue

[MimeticLie]

I took that statement as being ironic, given that it's a Democrat who's in office at the moment.

Re:Check your EULA... you probably can't sue

[delinear]

As far as I can see, unless they make you read and agree to the EULA before any money changes hands, there's no way such a clause added after the contract should be able to change the nature of the contract. It might be fairer if I were allowed to return the item if I don't agree with the EULA for a full refund, but since most places don't accept non-faulty returns on sonftware or consoles (and when they do it's only for store credit) I don't see how this could ever meet even the most rudimentary test of fairness required to form a contractual obligation.

Re:Check your EULA... you probably can't sue

[geekoid]

Arbitration is nice in theory, but in reality it gives business more footing, more power, and less accountability.

Re:Check your EULA... you probably can't sue

[Archangel Michael]

Dude (or Dudette),

You're simply blind. Both (D) and (R) are completely complicit in robbing us of our "rights". The (D) love to take away 2nd Amendment rights, while establishing "rights" that require taking from others to complete (health care) denying others of their rights. It is a mother's"right" to kill unborn babies, which deny babies the RIGHT to live.

This isn't to say that the (R) are innocent here either, because they are not. As long as any (D) or (R) holds office, our rights are being eroded. Yes, I'm a Libertarian, and I can't stand people who don't know what a "right" is.

Re:Check your EULA... you probably can't sue

[artor3]

Every vote in favor of this ruling came from a Republican. Every vote against this ruling came from a Democrat.

I know you need to rationalize your decision to vote for a Republican, but the truth is that the parties are very very different.

Re:A password crackers gold mine.

[Fractal Dice]

Also a good idea to not use real names and push credit card companies to develop a system of one-time tokens that are only good for a single buyer-seller relationship ( or even for a single translation ) so that the stolen information has little value.

Re:Good FUCKING Grief...

[Anonymous Coward]

In a country where corporations like Sony effectively own lawmakers, criminal remedies are impossible. Civil cases involving "lawyer whores" are the only recourse allowed (short of vigilantism).

Are the grounds for this lawsuit even valid?

[Mad Leper]

Hmm, something not right here.

PSN is free, so it's hard to imagine how anyone is entitled to any compensation there unless it's through a goodwill gesture by Sony (which they definitely should do).
No proof yet any credit cards have actually been compromised. And before you all get puffy and worked up, literally, NO PROOF of any CC problems that can be linked to the PSN breach have been proven (yet).
There's no way the banks would allow Sony to have access to CC accounts without being regularly audited, never heard of any problems there. So I would think it's safe to assume they've been following safe business practices or else we would have heard something by now.
According to latest reports, Sony reported the possibility of account & CC details being compromised a little over a day after they found out. Difficult to claim that's an egregious length of time given the circumstances.

With all that plus the fact that it's common knowledge that Sony has been repeatedly targeted by hackers and thieves out of revenge for Sony having the audacity to protect their network and customers, this lawsuit is going to have a very difficult time making any headway.

  So what is exactly this lawsuit about? Since this originates in the US (the most litigious country in the world) I say it's just more ambulance chasing i.e. business as usual.

Re:Are the grounds for this lawsuit even valid?

[raehl]

PSN is free. The multi-player game that doesn't work at all if PSN is down isn't.

Re:Are the grounds for this lawsuit even valid?

[greg1104]

Look at the Davidson data breach class action lawsuit for a case extremely similar to this one. There's also the (still pending as far as I can tell) Citizens Financial Bank breach case. Not following the standards of the industry for securing this sort of data can absolutely lead to a class action settlement, even if there is no hard written security standard.

Re:Are the grounds for this lawsuit even valid?

[tgd]

On top of that, there is zero liability, generally, for fraudulent credit card transactions, and they didn't have enough data for real identity theft.

Card numbers getting stolen are a pain in the ass, but I've never seen anywhere liable for anything more than once in a while paying for a year of credit monitoring service or something.

Re:Are the grounds for this lawsuit even valid?

[ProfMobius]

For what I gathered so far (I don't own a PS3), PSN is free, buying on it is not. The credit card is not required to register to PSN but only if you buy games on it.

You are the one without a clue, go play somewhere else.

Re:Are the grounds for this lawsuit even valid?

[Nemyst]

1) PSN is free, but that doesn't mean anything. The information I've given Sony have been given in the assumption that they would be kept with a modicum of safety. This was obviously not the case. It's even worse if the credit cards have indeed been compromised, in which case monetary compensation is far from being out of the question.

2) Reported a day after, where? I'm sorry, but saying it somewhere on the internet doesn't count. If you don't contact your customers on agreed-upon areas (email is the sole official contact anybody registering has given them), you haven't reported anything. I've received the email this morning. That's not one day.

3) Oh sure, so now because something's a target they're shielded from being dumb? Much of it is actually Sony reaping what they've sowed, but even notwithstanding that, it doesn't matter. If a bank gets a lot of frauds, does it mean it can stop paying back the customers?

Re:Are the grounds for this lawsuit even valid?

[The Moof]

There's also some additional services that require a card on record at Sony tied to your PSN account (Qriocity and Playstation+). There's also the stored card information for your wallet if you set that up as well.

Re:Are the grounds for this lawsuit even valid?

[chrismcb]

There's no way the banks would allow Sony to have access to CC accounts without being regularly audited, never heard of any problems there.

Really? Perhaps the banks don't know that Sony has access to CC accounts. AFAIK banks don't go around auditing their customers to see if they are complaint with storing CC accounts (and yes actually I am a bank customer. I wrote the code that sends the CC off to the bank. And no, we don't store the CC anywhere on our system. But the bank doesn't know that)

Re:Are the grounds for this lawsuit even valid?

[vegiVamp]

> PSN is free
Playstation Plus isn't.

> NO PROOF of any CC problems that can be linked to the PSN breach
Pretty hard to prove in the best of cases. You could just as easily go the other way and have Sony prove someone else leaked the card. You'd need to track down the source of the fraudulent charges and keep tracking right to the source in both cases.

> no way the banks would allow [...] without being regularly audited
Are you really suggesting that banks audit their corporate customers' software, on a regular basis?

> Sony reported [...] a little over a day after they found out
Umm... they've taken PSN down a week ago. I only just today received notification. They reported 'external intrusion' on their blogs almost a week ago. That tells me the 'possibility' was known from way back then.

Re:Are the grounds for this lawsuit even valid?

[Anonymous Coward]

In the case of people within the EU that're affected, whether it's free or not is largely irrelevant, I believe (IANAL). Organisations have a responsibility to protect any customer information they hold. Local laws vary throughout the EU but in the UK it'd largely be under the Data Protection Act.

That act, directly, doesn't provide any legal recourse for individuals (from memory) but the punishments for companies can be severe.

Re:Are the grounds for this lawsuit even valid?

[Cederic]

they didn't have enough data for real identity theft

Well, no, they didn't have full DNA samples, photographs of all scars and tattoos and a voiceprint to enable full replication.

I guess it's lucky that they can't do too much damage with name, address, date of birth, security question answers and credit card details.

Care to share yours?

Re:Are the grounds for this lawsuit even valid?

[Cederic]

You probably ought to read up on PCI DSS then. Start here:
https://www.pcisecuritystandards.org/merchants/index.php

The bank maybe doesn't audit you, but in this country they will demand certification from a QSA, and those guys will audit you because they're liable for your fuck-ups if they sign you off.

Re:Are the grounds for this lawsuit even valid?

[Anonymous Coward]

They stored CCVs. This is a cardinal sin in credit card storage guidelines. They could not have passed a legit PCI-DSS audit while storing CCVs. Either they fudged their audit or they aren't required to have one (non-US company maybe?)

Re:Are the grounds for this lawsuit even valid?

[nstlgc]

PSN is free, so it's hard to imagine how anyone is entitled to any compensation
So the people who entered their credit card info did so for shits and giggles? Obviously some part of the network required payment.

No proof yet any credit cards have actually been compromised.
"Yet" being the key word here. I've read a few posts from people who have already seen fraudulent charges on their credit card, so I assume the "proof" you're asking for isn't very far away.

There's no way the banks would allow Sony to have access to CC accounts without being regularly audited
Lol, what?

According to latest reports, Sony reported the possibility of account & CC details being compromised a little over a day after they found out.
I heard it took them 6 days, but even a day would be quite alot of time.

hackers and thieves out of revenge for Sony having the audacity to protect their network and customers
Obviously they're doing a shit job at both protecting their network and their customers. First those Anonymous script kiddies cripple PSN, then it gets hacked. Don't fool yourself, all they're interested in is protecting their own asses.

Apologist much?

Re:Are the grounds for this lawsuit even valid?

[delinear]

More likely if there is a danger of people cancelling they'll throw them some free gear.

Re:Are the grounds for this lawsuit even valid?

[nschubach]

We're in some pretty muddy water with this one. PSN is *NOT* free since you need to have a PS3 to use it (barring other devices that might use it, eg. PSP).

Technically, you do not need any Sony device to have a PSN account. You can create an account online.

You also don't need the device to "use" the account unless you consider "use" buying items. In which case, you'd still be wrong because you can download things from the online store to your PC.

Re:Are the grounds for this lawsuit even valid?

[geekoid]

They moment they know they were compromised, a statement to consumers should have gone out. Literally within minutes.
AN update late could give more specific information.

They should also redirect all attempts to connect to PSN to a page that shows the most recent information instead.

Re:Are the grounds for this lawsuit even valid?

[Khyber]

Sony Computer Entertainment of America.

That is clearly an American-based company.

Delayed Reaction..

[Billlagr]

Well, I recieved 'official' notification about this approximately 2 hours ago - 8.55am, April 28 (Aus EST). The email is vague hand waving at best, and they suggest once that the service is restored, the you change passwords and check your credit card statement. Of course, they couldn't have my CC details, because Sony wouldn't have stored such information in plain text, now would they...?

Re:Delayed Reaction..

[compro01]

Of course they wouldn't. This is Sony. They have their own non-ASCII, non-unicode, propitiatory format for storing text.

Re:Delayed Reaction..

[ozdeadman]

Of course they wouldn't. This is Sony. They have their own non-ASCII, non-unicode, propitiatory format for storing text.

mod this up, i find it hard to believe that sony would be using non-proprietary methods to store data given Memory Stick, MiniDisc, UMD etc

A departure for me-

[rogerdugans]

Usually I am against the rampant lawsuits over hot coffee and anything else the shills can think of, but this is one I am in favor of.
Sony seems to have taken over as the current best example of "Evil Large Corporation" in the public eye, and deservedly so.

Now if we could just get the pharmaceutical companies.......

Re:A departure for me-

[Voyager529]

Usually I am against the rampant lawsuits over hot coffee and anything else the shills can think of, but this is one I am in favor of.
Sony seems to have taken over as the current best example of "Evil Large Corporation" in the public eye, and deservedly so.

You must be confused, I haven't seen Sony behave in an evil way that is at all dissimilar to the other evil companies (MS, Apple, Nintendo, etc). So why should they be given the title of "best example of ELC".

Apple and Sony both sell devices whose firmware was jailbroken. Both jailbreak methods were made available through significant contributions from George Hotz. One of them brought Hotz to court. Guess Who.

Re:A departure for me-

[rogerdugans]

Usually I am against the rampant lawsuits over hot coffee and anything else the shills can think of, but this is one I am in favor of.
Sony seems to have taken over as the current best example of "Evil Large Corporation" in the public eye, and deservedly so.

You must be confused, I haven't seen Sony behave in an evil way that is at all dissimilar to the other evil companies (MS, Apple, Nintendo, etc). So why should they be given the title of "best example of ELC".

In this case they had a data security breach, we'll have to wait to find out if this was caused by negligence or not. Even if it was negligence, stupid =/= evil.

As said by another respondent-

Sony has for quite a while now been conducting themselves badly- rootkits, locking down devices and generally doing anything and everything they can to prevent consumers from being able to exercise their rights to use their purchases in any legal way they see fit.

I guess I just don't understand how developing a rootkit that will install itself on any customer pc a disk is accesses by can be looked at as anything but a criminal action.

Maybe its me....

Re:A departure for me-

[geekoid]

"Now if we could just get the pharmaceutical companies......."

to do what? cure more people? continue to make vaccines at close to zero profit? Continue to spend billions in research? Eliminate more diseases and plagues that had haunted mankind for it's entire history untill about 60 years ago?

Fuck you.

Re:A departure for me-

[praxis]

Now if we could just get the pharmaceutical companies to be more transparent with their pricing structures, especially when it comes to prescription coupons.

Just received

[flyonthewall]

This is one week after the shutdown:

"Add PlayStation_Network@playstation-email.com to your address book

"line" (to account for the junk filter)

PlayStation(R)Network

"line" (to account for the junk filter)

Valued PlayStation Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network. In response to this intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our network infrastructure by rebuilding our system to provide you with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.

Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity password, login, password security answers, and handle/PSN online ID. It is also possible that your profile data may have been obtained, including purchase history and billing address (city, state/province, zip or postal code). If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained.
  While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising that your credit card number (excluding security code) and expiration date may also have been obtained.

For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security, tax identification or similar number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit or similar types of reports.

We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority.
Please contact us at 1-800-345-7669 should you have any additional questions.

Sincerely,

Sony Computer Entertainment and Sony Network Entertainment

Sony was thinking about maintaining profits.

[elucido]

They could have warned you but they didn't. They knew it would cause panic and this panic could cause them to lose some customers.

Now we know 77 million customers are owned by hackers. We can thank Sony for waiting so long to tell us, and we can thank Sony also for caring more about DRM and security of their intellectual property than the security of personal critical consumer information.

What? Is your private information not as important or as valuable as theirs? I wonder how many celebrities and powerful families got their personal information compromised over this...

Incoming.

[westlake]

46 DC EA D3 17 FE 45 D8 09 23 EB 97 E4 95 64 10 D4

I intend to be elsewhere when the 70 million PSN account holders get a real live geek within their sights.

It is not going to be pretty.

Not to mention the money and firepower backing up those who sell products and services through PSN -

and the banks who finance and service the transactions. They too will be out for blood.

Re:SCEA or SNEA

[Penguinoflight]

Given that Sony simply imported the data from one "child" company to another I don't expect that the owner of the company matters. It interests me that by closing the service on one company and opening it on another (along with a completely new TOS), would clauses regarding forcing a customer to use arbitration then be rendered void? The EULA is a legal document which supposedly forms a contract between one party and another; by failing to continue to provide service on the original company sony has breached that contract.

What of the millions (of 77+ I'm sure there's a few) who have yet to agree to the new EULA. Even in the case that one or both EULAs contain requirements that users handle disputes through arbitration I'd expect many individuals would not be held to these requirements at all.

Any lawyers care to correct me?

Dont class action

[Bruha]

Sue the crap out of them and be rich, otherwise you'll just probably end up with free X days the service was down, and your lawyer will be rich instead.

Re:Dont class action

[xs650]

The real value of a successful class action suit is that it can get the point across to a company that it can be cheaper to behave honorably and competently than not.

If you get some money, that's just frosting on the cake.

Re:A week is long enough for hacker to do plenty..

[TaoPhoenix]

Yeah, so, they'll get a fine to offer affected customers a free downloadable game right? So what, they're just Custopeons.

But if you copy their game first, you're going DOWN terrorist!!

Not a lick of sense.

[westlake]

Sony seems to have taken over as the current best example of "Evil Large Corporation" in the public eye

It isn't Sony getting its reputation blackened. It is Anonymous, the geek, the cheat, the thief and the hacker, which the public sees as all of one kind.

Not this one

[symbolset]

This one is looking like a global crime network with money laundering facilities and boots on the ground. This one is going to sting, based on some reports of illicit card accesses that have happened in the past week.

Re:Not this one

[mywhitewolf]

yeah, a global crime network in the same sense that piracy is run by a global crime network. There are anonymizing services on the net for laundering money, and there isn't any need for boots on the ground, although the hack to get into the development environment on the PS3 was built by a larger group of players, this attack could have been pulled off by a single person.

Transaction servers should be write-only

[Anonymous Coward]

It should not be possible to get card data out of your transaction processing server. That should be obvious. It should be able to receive card data and a linked account, and accept and confirm transactions from the linked account, but it should be completely unable to transmit card data. Obviously, card data should not be stored outside the transaction processing server in any form, format or fashion.

Storing the CVV2 Number?!

[Anonymous Coward]

If I remember correctly, the post from yesterday mentioned that included among the data that was compromised were CVV2 codes (that 3-digit code on the back of your CC).

Here's an interesting point about storing CVV2 codes...
http://en.wikipedia.org/wiki/Card_security_code

For that alone, Sony should have all of its merchant accounts revoked immediately.

Guilt by Association

[TemperedAlchemist]

Because clearly, it's Sony's fault-- and not the hackers' fault-- that the hackers broke into Sony's network. Sony's questionably ethical business practices do not warrant them the blame. He's suing the wrong people, all Sony is going to do is throw their EULA in his face.

Re:Guilt by Association

[anonymov]

You say that like there have to be only one side is to blame in this.

Hacker should be sued by Sony, as he illegally accessed Sony's computes, and Sony should be sued by customers, as they entrusted Sony with their data which was given away by negligency.

Re:Guilt by Association

[TemperedAlchemist]

"We exclude all liability for loss of data or unauthorised access to your data, Sony Online Network account or Sony Online Network wallet and for damage caused to your software or hardware as a result of using or accessing Sony Online Network."

- PSN EULA

---

They're not liable for unauthorized access.

Re:Guilt by Association

[delinear]

I wonder why they didn't say that in their official press release. Maybe because they know it's not worth a damn and was only ever intended to put people off suing over minor indiscretions - it's a bit harder to say "hey, we lost the details of 77 million people but they agreed we have zero responsibility so go whistle". Still, if anything good comes out of this we can only hope that it's the courts ruling that EULAs are worth less than used toilet paper in order to prevent a possible public backlash.

Re:Guilt by Association

[geekoid]

Yeah, well I guess where going to see about how effective a statement in a EULA which isn't signed, that the business is fully aware most people don't read and don't understand, can be updated after the fact, puts all responsibility of negligence onto their customers is going to work out for them. Hopefully this goes to the supreme court.

I can't help but notice Sony hasn't put that into their press releases.

Re:Guilt by Association

[Khyber]

EULAS MAY NOT TRUMP PRE-EXISTING LAW.

Especially DATA PROTECTION LAWS.

Jesus fucking christ people get that through your thick skulls.

Re:Code?

[froggymana]

Hey! Who told you my password?

E-mail from Sony...

[LongearedBat]

I got this e-mail from Sony this morning. A little late, perhaps? <sarcasm>

Though here's a question: How many other companies have the backbone to own up quite so readily, instead of trying to cover it up to save face?

Don't get me wrong, I'm not trying to defend Sony (after all, it seems thay they're finally getting help to make their system more secure, implying that their efforts were not solid enough to start with). But what I am saying is that I generally don't trust businesses to keep secure personal and credit card information, which is why I didn't give Sony my credit card details (but sadly had to give my personal information.)

SONY BMG RIAA MPAA ETC

[NSN A392-99-964-5927]

These companies are all interlinked and they deserve a good suing. 77 million users cannot be wrong.... take that on the chin you cnuts!

Re:Why the delay in disclosure?

[ADRA]

That's just retarded, really? Why is Slashdot so full of trolling anti-Sony's? Have you ever been a systems administrator? It takes time and effort to actually detect and then judge the severity of a given attack. One week does not seem like a big deal from -woops we have a big problem- to sending out a formal acknowledgement of the issue. Hell, it would take at LEAST 1 day for a Sony rep to officially write up the disclosure in legally tin foil jargon and probably another for the notice to be translated into every language that Sony officially supports.

Re:Why the delay in disclosure?

[bloodhawk]

Hell, it would take at LEAST 1 day for a Sony rep to officially write up the disclosure in legally tin foil jargon and probably another for the notice to be translated into every language that Sony officially supports.

that there is a massive problem in itself, I think you are probably right but for their sake I hope your wrong as it says they were more concerned about their own arses than ensuring people were informed of the issue. In these cases the users at risk should be EVERYONES first priority, I hope it was just a case of it taking that long to sift through logs to track down what had happened and that then then immediately released the information (ie within a hour or 2 of knowing) otherwise I hope they get sued to hell and back.

Does anyone else feel raped?

[theKingofShit]

This would not happen to amazon, paypal or any other instance with 77 million users - with sensitive personal data. I'm still hoping that it wasn't criminally motivated intrusion. There is still a tiny chance, that the one who did it was just proving a point. Tried to play something last night, but it didn't feel the same any more. Might say that now i know how abused spouses feel.

is it just me

[luther349]

is it just me or does a certen hacker would have a reasion to desotry sonys network and get sony sued and this certen persion would have the talent to pull it off heh, but relly sony did need this realty check they have been riding a hi horse and even thretning custmers with moddded systems its nice to see the knife pointed at them. and the sad fact is the guy who is sueing is totaly correct sont was way overzaules that there ps3 and network could not ever be hacked and didnt bother to encrypt shit past the first stage of securty why we have the keys for both psp and ps3 and someone got dev acess to the entire network. who knoes what relly happond thow maybe it was a case of a disgruntled dev.

Re:is it just me

[Legion303]

You are an idiot.

Wait a Minute....

[Shifty0x88]

Wait a Minute... Didn't they take away the Install Another OS feature due to "security concerns."

And now the PSN has been hacked, my information taken and I'm now at risk of fraudulent credit card charges....

I'm sorry but where's my check????

So Sony, how about that Geohot?

[AbRASiON]

You've made an enemy out of a lot of the community.
I have 2 PS3's and 25 games on my shelf.
LEGITIMATE games.

Do you know why I purchased a PS3? The real reason I orginally purchased it? There was 2 reasons.
1 was God of War 3, which took 2 years after I got the thing and was surprisingly not as good as #2
2 XBMC was rumoured to be coming to PS3, via the loophole to the hypervisor through linux. More beautiful XBMC goodness.

You closed that loophole and I STILL forgave you because I loved the games, I forgave you guys for a lot of shit, a LOT - I even put up with taking linux away - but this Geohot thing was the final straw.

Even if my details are compromised as one of the customers, who cares. GOOD - fuck you assholes for treating the customers with utter contempt.

Looks like Hitler will join the suit

[MotorMachineMercenar]

Looks like Hitler will join the suit

If anyone should sue

[ThatsNotPudding]

it should be Visa and Mastercard. I doubt Discover would; they're just happy to be finally noticed by scammers.

Sony has never had a decent customer service model

[sarbonn]

This really doesn't surprise me at all. Sony has historically had a horrible customer service model in pretty much all of its products and services. I remember the days of dealing with Sony Online Entertainment, and realizing this was the wrong way to do business with people. The company has always been top down directed, in that they respond only when faced with a scandal or its customers start leaving in mass, which was done in the early days of Everquest due to some horrid PR decisions they were making. Fast forward to so many of their stupid responses and actions in other areas, like trying to maintain control over the music market, and now this debacle of PR with the playstation, and it really shouldn't surprise anyone else either. Sony historically thinks of Sony first, and the customers are only there to pay the salaries of those who feel they are unreproachable. Duane Gundrum http://www.duanegundrum.com/

I'm not worried

[senorpoco]

I am sure that if anyone tries to use these credit card details Sony's much vaunted DRM system will install a rootkit onto their computer. Right?

I'm usually against stupid lawsuits, but...

[JustAnotherIdiot]

...I really hope this guy kicks Sony's ass.

Re:SCEA or SNEA

[nomadic]

Most of these kinds of contracts allow the company to assign their rights in the contract to another party.

Wouldn't be surprised if...

[Chewbacon]

The root password was "password" after the random numer flaw was exposed in their encryption.

Where did the 75 million stat come from?

[Illpalazzo]

So 75 million people out of the 77 million filed lawsuits with a day and half of notice. Where does this information come from? As one of the 77 million people, who received the message from PSN that my account info may have been accessed. I've been spending my time reviewing credit card purchases for the last week and requesting a new card number. Honestly I think this issue is just getting so over exaggerated because of panic and misinformation. Now granted alot of this is because of the legal vagueness of Sony's email. But I'd like some reference to these statistics before I'll accept them as facts.

I got notified yesterday

[mapuche]

This is the mail (in Spanish):

Add PlayStation_Network@playstation-email.com to your address book

PlayStation(R)Network

Estimado cliente de PlayStation Network/Qriocity:

Hemos descubierto que entre el 17 de Abril y el 19 de Abril de 2011,
determinada información de usuarios de PlayStation Network y Qriocity
fue puesta en compromiso en conexión con una intrusión ilegal no autorizada
en nuestro sistema. Como resultado, las medidas que hemos tomado hasta la
fecha son las siguientes:

1) Temporalmente cerrado los servicios de PlayStation Network y Qriocity.
2) Puesto en contacto con una agencia de seguridad externa de prestigio para
conducir una investigación exhaustiva de lo ocurrido; y
3) Rápidamente tomar las medidas necesarias para fortalecer nuestra infraestructura
en red, y reconstruir el sistema ofreciendo una mayor protección de vuestra información
personal.

Realmente apreciamos y agradecemos vuestra paciencia, y estamos trabajando
muy duro y haciendo todo lo necesario para resolver este problema de una
forma rápida y eficiente lo antes posible.

A pesar de estar todavía investigando los detalles de este incidente, creemos
que personas no autorizadas han podido obtener vuestra información personal:
nombre, dirección (ciudad, provincia, código postal), país, dirección de correo
electrónico, fecha de nacimiento, nombre de acceso y contraseña de PlayStation
Network/ Qriocity, y PSN ID. Es también posible que vuestros datos de perfil
así como historial de compra, y dirección de cobro hayan sido obtenidos.
Si habéis autorizado una subcuenta asociada a vuestra cuenta principal a
otra persona, la misma información de esta persona ha podido ser obtenida.
A pesar de no haber evidencia de que los datos de tarjeta de crédito hayan
sido obtenidos no podemos negar esta posibilidad. Si has facilitado tus
datos de tarjetas de crédito a través de PlayStation Network o Qriocity,
debemos contemplar por motivos de seguridad, la posibilidad de que el
número de la tarjeta de crédito (no incluyendo el código de seguridad),
y la fecha de expiración de la misma hayan sido también obtenidos.

Por vuestra seguridad, os recomendamos que seáis extremadamente cuidadosos
con estafas vía email, correo, o teléfono preguntando cualquier tipo de
información personal sensible. Sony nunca se pondría en contacto con vosotros
de ninguna manera, incluyendo correo electrónico, preguntando por vuestro
número de tarjeta de crédito, número de la seguridad social, identificación
de impuestos o cualquier otro tipo de información personal de identidad.
Si alguien se pone en contacto preguntando por este tipo de información,
os aseguramos que Sony no es la entidad que requiere esta información.
Adicionalmente, si usas el mismo nombre y contraseña que los usados para
PlayStation Network o Qriocity para otros servicios o cuentas no relacionados
con Sony, recomendamos que también sean modificados.

Para evitar un posible robo de identidad o perdida financiera, recomendamos
revisar regularmente el saldo y movimientos realizados en vuestras cuentas corrientes.

Os agradecemos vuestra paciencia hasta haber completado la investigación
de este incidente, y sentimos mucho las posibles molestias ocasionadas.
Nuestros equipos están trabajando sin descanso, y nuestros servicios serán
restablecidos lo antes posible. Sony se toma la protección de la información
muy en serio y continuará trabajando para asegurarse de que medidas adicionales
son tomadas para proteger dicha información. Proveer un servicio de
entretenimiento seguro y de calidad para nuestros consumidores es nuestra
prioridad principal.

Para mayor información contáctenos en 1-800-345-7669.

Sinceramente,

Sony Network Entertainment y Sony Computer Entertainment

Re:Why the delay in disclosure?

[geekoid]

The moment they shut down, emails should have gone out that say there has been a breach, and they are investigating.

This is not a system admin issue, it's a management issue. A bad decision to not inform customers.

And the legal Jargon is boiler plate.

I have been in situations like this, admittedly no 75million people, but in principle it's the same.
Shut the networks
Notify customers of a down time do you possible breach.
Update every 12 hours on any progress. Even if the update is just a post saying it's ongoing.

Can you imagine you ISP shutting down all of a sudden an not notifying you for over a day?