PlayStation Network Accounts Compromised, Personal Information Stolen

[Firewind]

Just a heads up to other people here who use PSN

April 26, 2011 Sony Computer Entertainment has released a statement finally explaining why its PlayStation Network service has been down most of the past week, saying that an illegal intrusion into its network has compromised its database of user account information.

In a PlayStation Blog statement by SCEA's Patrick Seybold, the company claims an unauthorized entry into both the PlayStation Network and Sony's music and video service Qriocity was made by an unnamed group that compromised "certain...user account information."

According to a letter currently being sent to all of Sony's registered account holders, the company believes that "an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID."

Other compromised information across the PlayStation Network includes "purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers."

Sony says that while there is no evidence of credit card info being stolen, the company "cannot rule out the possibility," and advises users who have connected a card to their accounts that credit card numbers and expiration dates (though not security codes) may have been obtained by a third party.

Sony's letter goes on to suggest actions an affected user should take, including being vigilant about communications that ask for personal information, changing any passwords shared with a user's PSN account, and contacting U.S. credit bureaus to issue a fraud alert.

Sony has clarified to Gamasutra that this information seems to apply to all accounts, with Seybold telling us "Our investigation indicates that all PlayStation Network/ Qriocity accounts may have been affected."

PlayStation Network services are expected to be resumed within a week, says Seybold, after its system undergoes a "re-building" to provide better protection.

[Update: Sony has updated its support site with a FAQ about the attack.]

Source

[Neverslip]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

Yeah... I just found out from Joystiq. This is pretty bad. Good luck everyone.

[Takelli]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

Great... I JUST posted this too. >.<

[Kailea]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

oh please, nothing is going to happen.... move along

I even had people come in a trade in their PS3s today...people are overreacting and being pretty stupid in general.

[Gobo]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

oh please, nothing is going to happen.... move along

I even had people come in a trade in their PS3s today...people are overreacting and being pretty stupid in general.

What, really?

[Omgwtfbbqkitten]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

oh please, nothing is going to happen.... move along

I even had people come in a trade in their PS3s today...people are overreacting and being pretty stupid in general.

Sony sat on this potential fact for over a week. Kind of a big deal.

I guess you've never experienced identity theft before. I have. Ever have someone buy a few cell phones in your name and have a company float you the bill? I have.

People you don't know having access to your personal information? Kind of a big deal.

This is EXACTLY why I have hated Sony practice of storing credit card info on their service for various transactions, along with any other business that expects me to set up an auto-debit. If I can't trust them to secure themselves, I can't trust them with my money.

Luckily for me, I lost my card at TGI Friday's last week, prompting me to cancel and get a new one. Still, that doesn't quite cover my email, name and personal address which can still be used to set up transactions.

This is also largely why I've loved point cards or at least reloadable credit cards (which Nintendo seems to want for 3DS and its next console) for my game transactions. Sure, just giving your CC info to PSN made transactions easy, but it never made them safe. I'd rather keep that info separate and in my own hands.

I'm divided on whether or not to stay with Sony products right now. To be perfectly honest, all the games I have pre-ordered for PS3 coming out this summer, I could just as easily pre-order for 360 and I'd likely have a more secure network and better online community to boot. Hell, I have a feeling Nintendo's next console would get a bunch of games from either of those other systems, too.

The apathy behind Sony's online service has come full-circle We've gotten what we've paid for - lousy service with no security when online play is totally free. At least Nintendo's free online play doesn't come with that danger, Wii and DS CC transactions are all done manually and not stored anywhere. Someone was clearly thinking about my best interests there.

And too my knowledge, XBL subscriptions have always been separate from other transactions with MS, the data kept off the network, hell, you can buy subscription cards for it, too. I should never, ever have to store CC info on my console or unsecured servers.

Very big deal.

[Shirai]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

I'm happy that I haven't done any credit card transactions through PSN. >.>

[jenova_9]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

Why use credit cards? There are PSN cards in stores, mew.

[Firewind]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

What Jenova said. PSN has cards available and is no less secure than the systems that Valve, Microsoft and Nintendo use for their transactions. If anything Valve's is probably the lease secure since you only need a keylogger to get people's billing information from Steam. The logic that PSN is the least secure network when we have no evidence of people even ATTEMPTING to hack XBL and whatever it is that Nintendo use (that seems to change with every console) on the scale we have seen Sony's networks being hacked, is pretty flawed. It's like saying that painting a fence red must clearly keep away elephants because you've never seen an elephant in your garden since you painted the fence red.

Yes it is a big deal, you're talking to someone stuck on a credit blacklist due to ID Fraud (from one of my own family members no less) and finds it impossible to get a credit card or borrow money or even buy anything on finance. Are the hackings a reason to bash Sony? Well considering they have been suffering attacks from hackers over the last few weeks it's pretty naive to expect those hackers not to pull off shit like this. They could have been more transparent about it but considering that the dates given were when PSN was taken down, you can't say they have been doing nothing about it. Believe it or not, it would have taken some time to find out the damage and the effects. That and they simply may not have known the extent of what had happened straight away.

And worrying about people finding out your name and address is pretty silly considering that anyone registered to vote has that information easily available online. All online services ask for that information. It's very surprising the amount if information you can find out about someone with their e-mail alone, nevermind what you can find with someone's real name alone or address.

Really, anyone signed up to any sort of online service should expect shit like this to happen at some point. How often have SE had FFXI accounts compromised? How often have Blizzard have battle.net accounts compromised? How often do sites relating to online services get compromised? Thinking about it, how many people don't shred bank statements or mail in general? Even junk mail has your name and address on it. Then again I forgot that fanboy rants take precedence over the determination of thieves and stupidity of people.

[Omgwtfbbqkitten]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

What Jenova said. PSN has cards available and is no less secure than the systems that Valve, Microsoft and Nintendo use for their transactions.

Except that to even have a PSN account, CC info is required. Nintendo and Microsoft's systems, to my knowledge, don't even bear that requirement. You can totally do cards with Nintendo and MS.

Additionally, Nintendo does accept CC info for point purchases, but it retains none of that information upon completion of the transaction. Its not stored on their side or mine. Archaic, but effectively secure.

Security on PC is all on you. Always has been. You know keyloggers are a potential threat, so you have things like KeyScrambler or malware checks in your system and you try to avoid third party tool sites as a hard and fast rule. Its not going to stop idiots, but for MMOs and PC games, you tread those mod communities carefully and only visit the trusted ones.

You download from a random site you know nothing of, you get what you deserve.

PSN has no security at all and the fact that they sat on the info for a week before telling people is pretty much illegal. You warn customers the very second you suspect something's up.

Its only how every other business does it. This has gotten Washinton DC's attention now. This sort of irresponsibility toward your customers is beyond unacceptable.

I prize my personal info over my game collection, thank you very much and if being offended that Sony can't respect to secure that, much less warn me about it when its potentially stolen, makes me a "fanboy" about this, so be it.

I'm a Sony fanboy when I defend Sony's firmware updates and pressing charges against hackers - which they should do. I'm a 360 fanboy when I like Xbox Live - as a service - more than PSN. I'm a Nintendo fanboy just for enjoying my 3DS and Wii. And I'm a Valve fanboy, apparently. I've never owned a game by them personally, I just like how much respect they show their community, which makes me feel a bit safer about Steam, particularly given I'm not too terribly into modding anyway.

Whatever floats your boat. I am whatever you say I am.

[Kailea]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

since when does PSN require a CC? I never had to enter one, I use points cards like I do with all my systems.

[Omgwtfbbqkitten]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

since when does PSN require a CC? I never had to enter one, I use points cards like I do with all my systems.

Well, we could check to make sure...

OH WAIT.

[Raydeus]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

So it's a good thing Sony doesn't accept my card because I'm not from the right region after all.


Yay (I guess.)

[Malacite]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

Yeah, never buying anything off PSN directly ever again.

Points Cards from here on out. Thankfully, my shitty little card only has a $500 limit so it's not like too much damage can be done, but even still all the other stuff is plenty for Identity Theft.

I'm seriously tempted to ask my local MP about any possible legal recourse or if Parliament can even do anything. It's already started in the U.S. with a Connecticut Senator railing against Sony for waiting 6+ days to even notify people something was wrong.

Keep in mind there's something like 70 million registered users on PSN.

[Firewind]

Re: PlayStation Network Accounts Compromised, Personal Information Stolen

You never had to enter credit card info for PSN and you've been able to use top up cards for a long time.