We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network," Patrick Seybold, senior director of corporate communications for Sony Computer Entertainment of America, wrote on the official Playstation Blog today.

Among the possible information stolen:
Name
Address (city, state, zip)
Country
Email address
Birthdate
PlayStation Network/Qriocity password and login and handle/PSN online ID.

There is no evidence that credit card data was taken, Seybold writes, but they company cannot rule out that possibility.

" If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained," he wrote.

Sony is encouraging users to be especially aware of potential phishing scams from people using email, phone calls and mail to try and extract more personal or sensitive information from you. Sony also is strongly recommending that you change you password once you're able to log back into the Playstation Network.

"To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports," Seybold wrote

http://ca.gizmodo.com/5795923/sony-comes-clean-playstation-network-hackers-have-stolen-personal-data

I've been following this too. Fun, fun, fun.

Sony has been coy up to this point, though typical of most companies. Companies are always afraid to admit things like credit card breaches until instances of complaints about fraudulent charges start creeping up.

This has the potential of a MASSIVE security breach that could really do damage to Sony.

I prefer the 360 so I don't own a PS3 but if I did use my credit card on PSN network I would take the following safe guards today!

1) Cancel my existing card today.
2) Change email password that is tied to PSN account
3) Call Sony support and inquire how to deal with changing the ID/Password - can you do anything to the account at this moment while the service is offline?
4) Keep an eye out for any phishing attempts through email.
5) Get a 360 and wait for Gears 3.

So did anyone get an actual email from Sony w/ the details? I see posts all over the web today but nothing directly from Sony.

This has been Sony's only official statement so far: http://blog.us.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/ (was linked to at the end of that article) They said e-mails will be coming.

As of right now, there's no way to change the details of the compromised account.

This is the third large company to have compromised my details. I've never seen anything come from the others, but I'm pretty weary of everything anyway.

If Sony is admitting that they are going to be sending out emails about this, be wary of phishing attempts as this would be a perfect opportunity for the hackers (since Sony has admitted they have your email address) to take advantage of. Companies will never ask for things like account details or "verifying account" through personal information, passwords, CC numbers unsolicited through email.

Here in Japan the network shut down on monday afternoon. That sucks coz I was kinda addicted to Killzone 3. LOL Can't wait to play again.

Well, if you use a common password tied for things like your PSN account, email and gosh knows what else people do like banking/paypal etc I wouldn't be worried about playing Killzone but changing passwords.

I don't use my ps3 for banking and I guess that the ps3 browser can't log on paypal website. Since I didn't hook up any credit card I am not a bit concerned. I only buy money on psn cards. Lucky me.

You can't change any account settings mentioned unless you go online, which you cannot do now. You can of course cancel the credit card that's linked to the account if you choose.

I did get an email today. Oh, Sony.

Too busy raking in the cash to actually care about their customers.

Sony should have long ago had an outside consultant review the security of their network. And continued to have these reviews performed.

Also not treating their paying customers like criminals would help keep the animosity down. Don't get me wrong, I'm not condoning the action of the person who broke in, or blaming the victim, but sometimes when you push, people knife you back.

What do you think the over/under will be on the how long the network will be down? On one hand, the longer its down, the more it hurts any competitive edge it has with its customers. On the other hand, they got to get this shit straightened out and it might take some time.

I'm saying it'll be back up for next Tuesday's store update.

Oh, and it will be forgotten in about 4 months.

To early to tell as of this moment the consequences of the breach and the possible aftermath. It might be forgotten by some users but perhaps not congress (which has already peaked the interest of a senator).

No surprise here that a class action has been filed.

A California-based firm has filed suit against Sony, accusing the company of failing to adequately protect, encrypt, and secure its customer data. The suit seeks damages for the data loss and PlayStation Network downtime.

"We bought this lawsuit on behalf of consumers to learn the full extent of Sony PlayStation Network data security practices and the data loss and to seek a remedy for consumers," Ira P. Rothken, an attorney who filed the complaint, said in a statement. "We are hopeful that Sony will take this opportunity to learn from the network vulnerabilities, provide a remedy to consumers who entrusted their sensitive data to Sony, and lead the way in data security best practices going forward."

Sony's PlayStation network has been having issues since last Wednesday, but it was not until last night that Sony confirmed that hackers had obtained personal information from the network, which possibly included credit cards. Sony said it expects to "restore some services" within a week, but did not elaborate.

"Sony's breach of its customers' trust is staggering," co-counsel J.R. Parker said. "One would think that a large multinational corporation like Sony has strong protective measures in place to prevent the unauthorized disclosure of personal information, including credit card information. Apparently, Sony doesn't."

The suit was filed on behalf of Alabama resident Kristopher Jones, who has been a PlayStation user since 2009.

The lawsuit claims that Sony was aware of vulnerabilities with its system for some time, but does not provide details.

"[Sony] has been aware for a substantial period of time that PSN was prone to catastrophic loss of data from a security breach," according ot the filing. "Nevertheless, [Sony] failed to warn its customers of the problem or tried to prevent them from suffering system suspension from security breaches and data loss."

"Sony sat silently while consumers purchased defective PlayStation consoles and PSN service without warning customers about the risks inherent in purchasing and relying upon Sony's data security," the suit continued.

http://www.pcmag.com/article2/0,2817,2384523,00.asp

Got my email from Sony. But I don't even recall which card is tied to my PSN. Can't even log on to check...

AND, you're hit w/ this again if you're a Yankee season ticket holder. Add that to the recent Epsilon breach and you've got a trifecta. I'm 2 for 3.

http://gizmodo.com/#!5796391/yankees-accidentally-leak-personal-info-of-20000-season-ticket-holders

http://abcnews.go.com/Technology/epsilon-email-breach/story?id=13291589

Well, the Epsilon thing is just email address at least.

I'm officially pissed.

There are now reports of individuals complaining about fraudulent charges on their CC's. I guess we will know soon enough whether there is substance to these reports and if it is related to the recent breach. The victims think it is.

http://news.cnet.com/8301-27080_3-20058067-245.html

Yeah, with 77 million compromised accounts it is very likely that some of those people would have had fraudulent charges even without Sony's help.

Yup 77M accounts. I heard on the CNET podcast that the average CC fraud charge can be around $300. That's quite an amount that Sony would have to cover...

Not all PSN accounts have credit cards tied to them but yeah this could cost Sony billions of dollars. Depending on what information people have out there, another scary thing is the possibility of identity theft.

No letter here. I did read an announcement somewhere though so I keep checking my online statements. They didn't get PINs or expiry dates which helps somewhat, but not much. I'm trying to be optimistic and say tell myself that because I'm in Canada my data may have been stored in an alternate location. Doubtful though if the numbers on the amount of accounts hacked is accurate.

It would suck if I get nailed as I haven't even had my PS3 turned on in about a year (broken) and I haven't bought anything via the store in even longer.

Last I read they said that the Credit Card info was stored separately from the hacked info and that it was encrypted... not to say that it wasn't obtained though.

They say the CC info was in another table, not truly separate. But the table was encrypted. My question is, "where were the decryption keys stored?" If the answer is, "another table", I'll be really upset.

Good point Chris...

Just coming off the Geohot scandal, you know Hotz would have to pile on to Sony. I agree with him, the last things you want to do is make your customers feel like criminals (collecting IP addresses) and pissing of hackers. The latter is never a good thing, because they are always smarter, than the smartest working and towing the company line for the corps.

http://www.gamasutra.com/view/news/34339..._Of_Lawyers.php

Now add the fact that I've been hit w/ the Amazon storage outage. I use Jungledisk w/ Amazon's S3 for offsite backup of my personal photos/vids. I haven't been able to backup for 3 days. The outage is recognized but the fix is not.

Man, what's going on?

As I said in another thread relating the two topics: Skynet

I want a Skynet account.

Good lord.

http://www.bgr.com/2011/05/02/sony-suffers-another-major-security-breach/#utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheBoyGeniusReport+%28BGR+%7C+Boy+Genius+Report%29

This is completely Sony's fault. They were asked if they were taking the SoE servers off line, and they replied that they were a different network and not at risk.

What they should have done is taken them down too at that point for a security review.

Oh, and a clickable version of the link above:
http://www.bgr.com/2011/05/02/sony-suffers-another-major-security-breach/

Sony REALLY screwed the pooch. So what are we up to now 100 million with compromised private information?

I guess they're trying to outdo Microsoft's RRoD. Your move, MS.

I've been doing my research on which credit cards offer virtual cards that you can use in order to obfuscate your actual card number.

Citibank offers Virtual Account Numbers.
BofA has a similar feature called Shop Safe.

Something to consider. I am moving all my recurring online payments to VANs. I'm entering full paranoia mode.

Do recurring payments work with VANs? I thought they usually had very close expiration dates.

I had an unidentified charge show up on my card today. I'm trying to track down the source, but so far it seems fraudulent. Time to cancel, but it'll be such a pain, because I use that card several times every day. To be without it while waiting for the new one to show up, is going to really disrupt my life.

Oh good, I found the source of the charge. It should have not been billed, so the company reversed it.

Yes, you can do it for extended periods. I know you can do at least a year, maybe even longer.

Does anyone have a clue of when it will be back on?

The US North East is up. Stopped just shy of me in Maryland. Sony is taking it state-by-state, country-by-country. They said the whole of PSN will be back up by May 31st.

Oh, California just came up.

You should check the Playstation blog for Japan.

Well I guess that Japan network is still out then. Did you guys receive the 1 month playstations plus subscription for free?

Update on news!!
The PSN in Japan is back!!
My bad, After trying to log in they let me update but the network it still out.

Maryland is back up. At least I got signed in, and was able (required) to change my password. The Store isn't up, didn't look around much more than that. Time to sleep.

Chris do you have a link providing updated information regarding which U.S. states are back up?

According to Joystiq, they're all back up now.

Thanks Charles, that must have just recently happened ... a couple or three days ago it was still down here.

Same situation as ClubNeon here in S. Florida. Can get the newest update and change my password. That's it , though.

My son is anxiously waiting for Canada to get back up and going, he just bought a PSP Go with his birthday money. He was able to get the new updates etc., but the store is still down.

It was up yesterday for me in Eastern Canada. However, I am still waiting for my password reset email. Web page said it could take up to 24 hours.

Why isn't Japan back up yet? Because the government says, "no", until Sony shows the holes are plugged.

http://www.tekgoblin.com/2011/05/16/japan-says-no-to-playstation-network-restart/

Good for Japan....at least someone is holding Sony accountable. Hopefully this makes it more secure for everyone.

I did see that PSN users are getting free games out of this.

I think I'm going with infamous and wipeout HD, but I am open to suggestions.

I think the US should've taken Japan's lead.

http://www.bgr.com/2011/05/18/sonys-playstation-network-password-reset-page-compromised/

This is VERY sad (or pathetic really) for Sony. Fortunately, because of all these recent breaches, I sucked it up and made special aliases for different sites. I changed my PSN email and password.

I'm curious...what would it take for you guys to stop trusting Sony to the extent you stopped using psn?

Once they tell me the moon is NOT made out of cheese.

I mean, c'mon!!! Puh-lease!!

HAHAHAHA! That reminded me of this SNL skit. Hilarious!

By far one of my favorite impressions from SNL!!

That is a great skit, Cam!!

I haven't missed it much, but I don't use it much either. I certainly don't pay for the upgraded service, so at least I had no credit card info on file to get stolen. I don't know that they got anything from me that can't already be gained elsewhere.

I'm listed in the phone book, spammers have my email address. Beyond that I'd have to go back and look what else is in there, but I don't think it is much.

One of my favorites too, bud.

You know, that's a fair question. I like a lot of the downloadable content and it's nice (for me) to share trophies and the like on social networks.

Would I give that all up and just play straight from the disc? Probably not. I have created a new email just for services like this so at least I can corral the problem a little better.

PSN was back up this weekend and then this.
http://www.joystiq.com/2011/05/18/psn-website-sign-ins-disabled-after-users-identify-potential-exp/

Today, they had this.
http://www.bgr.com/2011/05/20/sony-security-slump-continues-subsidiary-so-net-entertainment-hacked/#utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheBoyGeniusReport+%28BGR+%7C+Boy+Genius+Report%29

Sony's having the WORST online saga I've ever seen. I hope the users of the world don't forget this and let it blow over. I'd like to see gov't make companies like Sony keep our info more secure. However, I'm sure we'll still have those stupid cases where some guy from the insurance company carries all client info on his laptop and then it's stolen from their car. (Which happened to my company w/our medical insurance provider.)

Sony was directly targeted because of their actions. Unfortunately I fear we'd see the same results if many of the other large companies were targeted who are not used to continual attacks. Microsoft, Google, and some other high profile places are used to continually being probed, so they are more on their toes. As sad as it is, unless threatened many companies do little to maintain the security of their Internet facing resources.