Slashdot Mirror
Sony Breach Gets Worse: 24.6 Million Compromised Accounts At SOE
An anonymous reader writes with an update to yesterday morning's news that Sony Online Entertainment's game service was taken offline to investigate a potential data breach related to the PSN intrusion. SOE has now said that they too suffered a major theft of user data.
"... personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007. The information from the outdated database that may have been stolen includes approximately 12,700 non-US credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain."
Is it that they are so unprepared that they didn't know it until today, or were so diabolic that they didn't tell anyone yet? Just feeling great for not having ANY money on the net.
This is what happens when someone manages to jump the fence of your "walled garden".
Seven puppies were harmed during the making of this post.
They are just pissed that somebody stole a lot of personal data, and took over a bunch of computer systems, and it wasn't them.
Hey guys, let's keep around credit/debit card billing data from 2007 all online. Deleting it after 6 months of inactivity could hurt sales!11! There's no cost to keeping it around, nothing that would pass an accountant anyway. Let's pay ourselves a bonus for our forward thinking.
I haven't played everquest since 2002 and I got a notice. Luckily for me all that credit card information is outdated and wrong. Event the mailing address is wrong. How someone was able to access this data is beyond me. I cannot, for any reason, think of any justification Sony could have to store something in a manner that a developer could access at this level.
Sony is going to have one hell of a class action lawsuit in it's hands.
At this point, I'm almost surprised the password wasn't stored in plain text. Then again, given the magnitude of the breach, I'm betting on it not being very hard to break the hashed password.
Fear is the mind killer.
If the person who stole the SOE accounts could get in contact with me, I've been trying to reset my SOE password for 2 months now, and it hasn't worked. Could you tell me what my password is?
Moral of the story is to not piss of a very capable hacker community buy going after their heroes.
It the way of the future!
Did you miss the first line of TFA?
"An anonymous reader writes with an update to yesterday morning's news that Sony Online Entertainment's game service..."
I think I'm getting a sense of what might be going wrong with high-frequency trading...
Help! Help! I'm being repressed!
Please, a true Slashdotter doesn't even finish reading the headline before posting.
Everyone was too pissed off at Sony to stop and think for a second: MAYBE the reason behind the removal of "Other OS" and the gross over-reaction to GeoHot is because Sony realized that their entire operation had more holes than swiss cheese? It had very little to do with being control freaks or preventing homebrew: perhaps Sony has all this time been living with a faulty-by-design network and even "Other OS" could have exposed it?
That "PEE" you saw in your spaghetti-o's was apparently no abbreviation...
"...there are some things that can beat smartness and foresight. Awkwardness and stupidity can." ~ Mark Twain
I received an email from Sony Online Entertainment this morning for some reason. I have never given them my information for anything. Now I'm nervous.
I object to power without constructive purpose. --Spock
First of all, you need to remember who's running this country, and it's not us. It's big corporations like Sony. They can essentially screw of all of us with impunity and if they go to far, the government gives them a slap on the wrist as a show of good faith to the people.
Consider the SEC. When they fine some trading company $20million for some illegal trading activities, do you really think that's a big deal? Of course not because they company made $100 or $200 million doing the illegal trade. To them, the fine is a cost of doing business. It's the kickback to their partner in crime, the government.
You're not going to get much out of Sony. And the government won't force much out of Sony. You have only one way of controlling this issue, and that's to vote with your wallet and stop buying *anything* connected to Sony. That means even carefully picking what movies you see this summer.
Only if Sony was to suffer considerable losses by people abandoning them en masse would they ever get the hint. But as long as they are profitable, they can continue to screw their customers, because their customers keep buying their shit. It's like you WANT to be tortured.
If telephones are outlawed, then only outlaws will have telephones.
Amazing how you could quit SWG out of post NGE Disgust and still get nailed.
should probably become the norm, not only after a fraud attempt is noticed/reported.
To-do List: Receive telemarketing call during a tornado warning. Check.
So, when are all you losers going to wake up?
Sony just wanted your money, they don't give a crap about you, your rights to privacy, or even making an attempt at keeping your data secure.
If you purchased a Sony product in such a way that they've got your credit card number, you're at risk, and it doesn't seem to matter since when; since the beginning of Sony on the Internet. Hopefully, those of you using Sony Online since the days of the Playstation (one), only have expired credit cards to worry about, but anyone who has used Sony recently is at more risk.
Throw out your Playstation 3. NEVER AGAIN purchase a Sony Product, do not buy their records, do not watch their movies, do not buy their headphones, MP3 players, e-book readers, or any of their other trash.
YOU MUST SEND A MESSAGE: I suggest even writing to Sony if you're their customer and TELL THEM that you are boycotting their products and you are advising your family and friends to do the same.
You *can* live without their crap. Surprisingly, there's a world out there. With trees, grass, flowers, and girls. Put down the controller, sir, and step away from the TV.
If telephones are outlawed, then only outlaws will have telephones.
I love the way corporations do this, just wait for a big news story (Osama's dead) and then start releasing the full extent of the disaster. The same principle worked for the cigarette companies. They were set to be torn apart of lying about the dangers of smoking and genetic modification to increase addiction, then along came 9/11 and all was forgetting. All you got to do is stonewall until a bigger problem comes along.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Yup, a friend of mine had played Everquest a while ago, and woke to find that email waiting. Who ever sent it knew what addresses were used for SOE games, and targeted them directly.
Looks like innovyx might have taken it down already, thankfully.
So if I bought a Sony Blu-Ray player a while back, and had to create an account on their site to "access" the device, it appears that account I created has been compromised.
We play the game with the bravery of being out of range
Sony's method of protecting private data!
http://www.vgcats.com/comics/?strip_id=302
You must master your joystick like a fisherman masters bait! - Gimpy
This will only get worse unless everyone who has done any business with Sony changes their passwords to all other accounts.
Each account to each website must have a unique password. Password re-use is what hackers depend on to leverage their attacks.
This can and will only get worse until users compartmentalize. One unique password per account always.
I keep hearing about intrusions that result in data theft, including credit card numbers, etc. Can someone tell me why on earth this information is being stored as plain-text and not as encrypted files? Unless of course the data is encrypted and the passphrases are stored in open-text files with a filename of "password_to_our_files.txt"
While I take no pleasure in the fact that people's financial data has been compromised, my intense dislike of Sony and its business practices is severely inhibiting my ability to wipe an evil little grin off my face.
Chas - The one, the only.
THANK GOD!!!
I've used Sony Online Entertainment for a decade. I generally do not purchase new Sony products. I have yet to receive anything from Sony indicating that my information may have been stolen. I know they have my correct email because I recently contacted them and they replied to me. I would be weary of anything sent to you. You should ensure you verify the "party" sending you the notices.
Aside from that, I do find it a bit disingenuous that Sony is making a PR announcement that basically says that "your information may have been stolen so we shut down the services", and go to the credit card service bureaus if you have further questions about your credit history. I don't like this because 1) an annual credit report won't flag this as you only get it once a year, and 2) everyone should already know they have an annual credit report entitlement so they are just telling us something we (should) already know.
So, for me reading that I am thinking "wow, this irresponsible company let 77 million people's personal identifying information out into the wild and the best they can come up with is to tell us to check with the credit reporting agencies. That that is nothing more than an effort to pass off part of the obligation "owed us" for what happened".
Further, Sony indicates they'll help you get in contact with an identity theft protection company to help you protect yourself. That does little now (and as a matter of fact, they aren't going to pay for it, they are just going to point you in that direction).
Everyone should be real weary of a company that tries such disingenuous tactics to offload responsibility from themselves.
And, finally, 77 million people's personally identifying information from the US (roughly)? Well, there are 300 million people in the US comprised of about 100 million families. The potential is that they have provided the credit card, address, phone number, email addresses of nearly 3/4 of American families to cyber criminals to do what they will and leaving responsibility for cleaning that up to the credit agencies and you (by introducing you to an identity theft protection scam).
This is an incredibly important breach that should not be put off so lightly.
You can lead a man with reason but you can't make him think.
Really? Then why haven't we seen any massive credit card fraud yet? Sony is claiming at over 10 million CC numbers were "stolen" and that was from a hack done more than 2 weeks ago.
If these were career criminals, why haven't we yet seen the horror stories of millions of dollars of goods shipped to Romania, with average joes holding the bag on the bill?
And why target Sony? Amazon would have far more data, as well as Facebook. Or, hack Microsoft's Xbox network which has more users in the USA. Why wasn't Nintendo targeted?
And if you're going to say that the perpetrators somehow knew that Sony's security was weak, then you're pointing to an inside job.
Sony appears to have been targeted because they are a bunch of douches. And judging by the low level of fraud so far, I'd say that the hackers are showing some restraint about harming the average joe while doing massive damage to Sony's image.
That doesn't sound career criminal to me, that sounds like vengeance from the user community after "Other OS" was removed.
Notice how the PS3 ads are off TV? They need to change their slogan to "It only does nothing".
If telephones are outlawed, then only outlaws will have telephones.
So, when are all you losers going to wake up?
Corporate America just wanted your money, they don't give a crap about you, your rights to privacy, or even making an attempt at keeping your data secure.
If you purchased an American product in such a way that they've got your credit card number, you're at risk, and it doesn't seem to matter since when; since the beginning of the credit card. Hopefully, those of you using goods and services since the 1960s, only have expired credit cards to worry about, but anyone who has used credit cards recently is at more risk.
Throw out your modern toys. NEVER AGAIN purchase any products, do not buy their records, do not watch their movies, do not buy their headphones, MP3 players, e-book readers, or any of their other trash.
YOU MUST SEND A MESSAGE: I suggest even writing to the President of the United States if you're their customer and TELL THEM that you are boycotting their products and you are advising your family and friends to do the same.
You *can* live without their crap. Surprisingly, there's a world out there. With trees, grass, flowers, and girls. Put down the controller, sir, and step away from the TV.
All jest aside, I never expected Sony to care about me, but I have been surprised by how brazenly customer-hostile they are. I have been boycotting Sony and spreading the word about just how crappy they are for the last several years.
With Sony in so much trouble, with a loss of credibility, and with the Japanese semiconductor industry somewhat disrupted,will the PS4 be cancelled?
After Sony's initial admission of the PSN breach, a lot of people pointed fingers of blame at the PS3 hackers without so much as a shred of evidence either way.
Now that it appears SOE was also penetrated at approximately the same time, I think it's fair to ask just where the penetration occurred, how much customer data was accessible across Sony's networks, and what (if any) internal safeguards were supposed to be in place. There could be multiple penetrations through several vulnerable points, but this looks even more coordinated and planned than initially suspected. If Sony hasn't investigated IT employees, it's time to start -- at minimum, someone has loose lips or careless behaviour. At worst, someone sold them out.
Really? Then why haven't we seen any massive credit card fraud yet? Sony is claiming at over 10 million CC numbers were "stolen" and that was from a hack done more than 2 weeks ago.
Perhaps there is a delay because reports will come from individuals not a massive company.
If these were career criminals, why haven't we yet seen the horror stories of millions of dollars of goods shipped to Romania, with average joes holding the bag on the bill?
Banks are pretty good at looking after their money. Haven't you ever had them contact you about suspicious purchases? I know of two people who have had multiple thousand dollar charges on their credit cards due to this. Interestingly enough one charge was at an Apple store for around $5000 which he joked would probably buy them two Ipads. The other works for Sony... go figure.
And why target Sony? Amazon would have far more data, as well as Facebook. Or, hack Microsoft's Xbox network which has more users in the USA. Why wasn't Nintendo targeted?
Perhaps how the hack was pulled off would shed some more light on this. Baseless speculation: Perhaps it has something to do with implicit trust of the client...
That doesn't sound career criminal to me, that sounds like vengeance from the user community after "Other OS" was removed.
" You mean that feature that was included so the PS3 could be classified as a computer to get it into certain countries under a different tax status which ultimately failed and they subsequently removed?
Notice how the PS3 ads are off TV? They need to change their slogan to "It only does nothing".
It only does identity theft.
Man blir trött av att gå och göra ingenting.
I couldn't tell if the spam was a result of an account of mine being revealed by Sony (I don't even recall having one, but who knows in this age of demanding accounts be created to access basic information at every website) or if the spammer was merely spoofing having the information. They used "playstation.sony.com" as the hostname in their certainly phony email address, so they're intimating something.
The email consisted of a few random characters (letters and digits) in the subject and a couple mroe in the body. Almost certainly a bounce-test. Likeley winnowing the database to improve its price on the market.
But, anything that can be bounce-tested can be traced to its source. I say we send in the SEALs when they get back from their two-week hookers, booze, and cigars mission.
77 million is worldwide, not in the US (Xbox Live is only 25-30 million worldwide, and it's considered more popular in the US). Sony has already stated they will be helping with identity theft protection services, though what kind of assistance they will be providing is unknown at this point.
Like a million souls crying out
"This is no surprise."
(You can tell that I'm not a great SW fan.)
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
PCI/DSS standards clearly dictate that all customer data, when "at rest" (i.e. on disk, in a database, etc.) needs to be encrypted: https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf: "Do use strong cryptography to render unreadable cardholder data that you store, and use other layered security technologies to minimize the risk of exploits by criminals" That Sony (and all the other businesses and institutions that have been hacked, left laptops to be stolen, etc.) doesn't do this is inexcusable. Had this data been properly encrypted, it would have been unusable to anyone. It's trivial to incorporate this encryption as a part of the design.