Slashdot Mirror
Sony Sued For PlayStation Network Data Breach
suraj.sun writes "Like clockwork, the first lawsuit resulting from the security breach of the personal data of more than 75 million Sony PlayStation Network customers has been filed. The suit was filed today on behalf of Kristopher Johns, 36, of Birmingham, Ala., in the US District Court for the Northern District of California. Johns accuses Sony of not taking 'reasonable care to protect, encrypt, and secure the private and sensitive data of its users.' He also believes Sony took too long to notify him and other customers that their personal information had been exposed. Because of that, the complaint alleges, Sony did not allow its customers 'to make an informed decision as to whether to change credit card numbers, close the exposed accounts, check their credit reports, or take other mitigating actions.'"
the great battle of our time...
Maybe this lawsuit will require them to come forward with the steps they *did* take. Up until now, it's largely been speculation. If they locked the door but left open a window, I want to know. And I want to know how open that window was left.
I still have yet to hear a single word out of Sony. Had I not seen the Playstation Blog post, I would have known NOTHING about the severity of this issue until it hit all the major news outlets.
Sadly, I know how this is going to turn out. There will be a class-action suit in which Sony is fined heavily. But the vast majority of the money will go to some shark lawyer, and the only thing the people affected by this will receive is a free 1-month subscription to PSN+. Actually, I'll be surprised if they even give us that much.
If this DOES go class-action, I will definitely be on the lookout for my notice to opt out. If I see any erroneous charges on my card stemming from this massive amount of incompetence, I want to retain my full legal right to bring my own suit against Sony where they will be required to provide me with credit monitoring and credit fraud protection. I'm sorry, but a boilerplate "we're sorry" and some token gesture are NOT going to cut it here.
"So after all this, you make my case for me. To end this stalemate, you must die..."
It takes time to find out what has been compromised. The hacker won't just come out and say "All your base are belong to us" Sony told us when they found out. If they did say that there is a possibility on day one that it may be compromised then there would be a lot of hectic and closing bank accounts on an hunch. If nothing had been compromised and they told us it may be (on day one) then people would be mad and still sued Sony for misleading them. Crap happens, suing doesn't make it better. Plus nobody said you had to create an account, nor did you pay for it.
46 DC EA D3 17 FE 45 D8 09 23 EB 97 E4 95 64 10 D4
sysadmins and parents of newborns get the same amount of sleep.
I'm not sure I buy that first part, given that no online service is ever going to be 100% secure.
Reasonable care would imply robustly isolating transaction processing systems and user accessible systems from systems that store primary account numbers such as credit card/bank account numbers from online/public access systems such as the internet, or the playstation network.
Reasonable care would include complying with PCI requirements, relating to auditing, security practices, separation of computer systems by role, and enforcing strong unique access credentials for users and systems.
So that a compromise of the publicly accessible network cannot lead to compromise of the account numbers.
This is highly doable. The only commands/services the PSN/publicly accessible servers need from account servers is a command to "add a new account number" to the database linked to a certain customer, a command to "erase an account number", a command to list privacy-filtered summary to display a 'delete' user interface, and a command "authorize/charge a transaction to account number" (without revealing what the number actually is to the transaction processing server).
Thank you Mr. Armchair Expert!
It's funny how Sony works so hard to protect their data and content via all their DRM attempts, when it's their customer's - not so much. On the other hand, they now have something to point to when people want to run whatever OS they want to run on their machines. Still, they can't stop it, they should focus on keeping their customer's credit card info out of harm's way (remind me why they need to keep persistent credit card data anyway? That should be an opt in only type of thing, with a required expiration date otherwise.) On a related note, when I set up a new account at my bank they only allow alpha-numerics with no special characters. WTF? Try to explain rainbow tables to a bank representative. So I used all of them ... I had the longest password she had ever seen.
you are in a twisty maze of different passages.
Actually I just got a notifaction from Sony abou this today.
And According to this http://vgn365.com/2011/04/26/psn-users-reporting-hundred-of-dollars-stolen-from-them/
The CC's are already in the wild.
I know Visa is aware of the issue. They have reissued me a new card based on this information.
So yea it could go somewere
And sitting on something like this for a week -is- a problem. When you have possibly exposed the equivalent of 25% of the US population to credit card fraud, the world needs to know. This isn't some "oh whoops, one of our laptops is missing" instead this is a data breach affecting 77 million people. And to say -nothing- is completely irresponsible. A week is a pretty long time to not say -anything- and to just hope that it will go away.
Even someone who has your personal information for a few hours can cause havoc in your life, let alone for an entire week.
Taxation is legalized theft, no more, no less.
Our wonderful, conservative-activist Supreme Court just ruled today that any company may stick a line in their EULA stating that by using their product, you forfeit the right to sue, and must instead use a private arbiter of the corporation's choice. They based this decision on a 90 year old law that was written to cover maritime shipping disputes.
Of course, since most contracts these days state that the corporation has the right to change the terms at any time without notice, this basically means that you can no longer sue a company that you've entered into a contract with.
Still think you have rights? Not as long as a Republican holds office!
In a country where corporations like Sony effectively own lawmakers, criminal remedies are impossible. Civil cases involving "lawyer whores" are the only recourse allowed (short of vigilantism).
Hmm, something not right here.
PSN is free, so it's hard to imagine how anyone is entitled to any compensation there unless it's through a goodwill gesture by Sony (which they definitely should do).
No proof yet any credit cards have actually been compromised. And before you all get puffy and worked up, literally, NO PROOF of any CC problems that can be linked to the PSN breach have been proven (yet).
There's no way the banks would allow Sony to have access to CC accounts without being regularly audited, never heard of any problems there. So I would think it's safe to assume they've been following safe business practices or else we would have heard something by now.
According to latest reports, Sony reported the possibility of account & CC details being compromised a little over a day after they found out. Difficult to claim that's an egregious length of time given the circumstances.
With all that plus the fact that it's common knowledge that Sony has been repeatedly targeted by hackers and thieves out of revenge for Sony having the audacity to protect their network and customers, this lawsuit is going to have a very difficult time making any headway.
So what is exactly this lawsuit about? Since this originates in the US (the most litigious country in the world) I say it's just more ambulance chasing i.e. business as usual.
The problem is that it is never a "well funded crime kingpin" and most often a 15-30 year old or an (ex) employee that noticed some gaping, obvious security flaw. Data breaches like this are rarely the work of huge "cyber gangs" and mostly the work of individuals who noticed some huge flaw that Sony had. The crime kingpins wouldn't bother with something like this because it is a whole lot easier to sell botnets with 3nl@rg3 y0ur p3n15 spam.
Twenty years ago you may have been right, but these days botnets are a multi-million dollar operation, underground black markets sell botnet time just like Amazon sells computer cycles, and cyber-gangs sell credit card numbers for a few dollars a pop. Cracking isn't the sole province of bored kids typing away from their parents' basement anymore; it's an industry, staffed by professionals.
Wow, I don't think you actually read that document. That opinion had absolutely nothing to do with Products or Services, and it doesn't disable class status for lawsuits. It states that an arbitration agreement that disallows class arbitration is allowable. Basically, if you sign away your right to arbitration by class action, that is valid, and you can't later invoke class-wide arbitration.
Lots of misinformation around here sometimes.
When I ran a server that contained sensitive customer data, I left the database open and without a password. That way if someone was going to hack me, I didn't have to buy a new password. Analogy fail.
Which means every contract consumers will deal with just had that clause added.
Smart man. I leave my car unlocked too so the crack-heads can just take the $1.27 from my ashtray and save me the trouble of buying a new car window every time I park out on the street.
Problem here is, it wasn't Sony's $1.27 that was lost. It was my stuff lost, and 77 million other people..... The biggest problem of all is that Sony did not alert their customers in a timely manner. Fuck Sony.
Well, storing the passwords in plaintext rather than hashed seems to me like a fundamental breach of any rational standard of care.
It should not be possible to get card data out of your transaction processing server. That should be obvious. It should be able to receive card data and a linked account, and accept and confirm transactions from the linked account, but it should be completely unable to transmit card data. Obviously, card data should not be stored outside the transaction processing server in any form, format or fashion.
Sony as an example of quality?
Are you trolling us?
Sony hardware is just as good quality-wise as the rest; only their prices are quite a bit above.
Sony hardware is just as good quality-wise as the rest; only their prices are quite a bit above.
These days. Back in the days of the green power button, you could count on Sony to produce a pretty darn good product that was at least as good as any other competitor.
Being an Xbox Live player (hate to say this cause its MS we are talking about) but you can enjoy gaming without the posibility for account Hijacking.
That's actually not true. XBL support has a notoriously bad track record when it comes to social engineering and giving away your account details to attackers. There were quite a few articles about it a few years back (here's one from a quick search). I think it's actually more of a threat since a valid credit card is required for XBL Gold accounts.
No. that is not all that was lost. That data get put towards another pile of data. Just because you can't think of how to use it, doesn't mean that someone else can't leverage it.
"For starters, they transmitted CC numbers in plain text over the Internet."
No they didn't.
They transmitted CC numbers over SSL over the internet, and some dipshit reinvented the wheel and "discovered" that he could spoof a cert on his own system and decrypt his own data, then he started claiming the info was sent unencrypted, and people like you read the headlines and started making the same claim everywhere else.
Sony is an absolute shitfuck of a company (to coin a phrase), but you can't claim this one with a straight face.