PSN Hacked, Private Info Stolen

[rpgdemon]

Legally, once you know of a security problem/breach, you must inform your users about it.

Even if you hate "as a business": As a business, Sony knows that if they don't comply with this law, the lawsuits et cetera are going to be monumentally worse than the bad PR.

Ergo, if Sony knows that they've had data compromised, they will report it. That they haven't reported it until yesterday makes it seem that they didn't know that the hackers had access to user data until yesterday. If they did, they're on grounds for numerous suits and fines.

[Bells]

From kotaku just now

While Sony discovered that hackers had broken into their Playstation Network on April 19, it wasn't until nearly a week later that the company understood the full scope of the breach, a Sony official tells Kotaku.

The company learned that customer data was stolen on Monday, only after an outside security firm conducted days of forensic analysis, Sony said.

U.S. Senator Richard Blumenthal publicly questioned today Sony's failure to "immediately notify affected customers of the breach and to extend adequate financial data security protections."
The letter, written to Sony Computer Entertainment of America president Jack Tretton, echoes the concerns of Playstation Network members who have been increasingly bothered by the lack of information from Sony.

Speaking to Kotaku tonight, SCEA spokesman Patrick Seybold explained the apparent delay in notifying customers.

"There's a difference in timing between when we identified there was an intrusion and when we learned of consumers' data being compromised," Seybold said. "We learned there was an intrusion April 19th and subsequently shut the services down.

"We then brought in outside experts to help us learn how the intrusion occurred and to conduct an investigation to determine the nature and scope of the incident. It was necessary to conduct several days of forensic analysis, and it took our experts until yesterday to understand the scope of the breach. We then shared that information with our consumers and announced it publicly this afternoon."

About 4 p.m. Eastern Tuesday, Sony started notifying their Playstation Network members that private data including names, addresses and perhaps passwords were stolen from Sony's database. The company doesn't believe credit card data was stolen, but isn't positive it is secure.

I'll be cinic and predict that everything Sony says most of you will call "bullshit" on it, even though you just said that the Senator who was full of shit was "right on the ball" about everything he said Sony did wrong...

Still, everything reported so far is on par with the reasoning Sony is presenting now and goes along with what i said about there being a difference between being Reckless and being Diligent on how to provide information for your costumers for a crime that affects them too.

[Eltargrim]

Honestly, I believe Sony.

Mainly because delaying the announcement until now, if they could have announced it previously, doesn't make sense. What do they gain from the delay? Practically speaking, nothing. What do they stand to lose? A hell of a lot.

[Solid Snake]

Honestly, I think we all need to set aside our fanboyism for our respective consoles and mutually agree that Sony fucked this up.

I say this as a Sony fan, as someone who still proudly prefers the PS3 over the X360 and the Wii, and as someone who's profoundly disappointed in Sony's handling of this entire situation.

A lot of Sony fans seem to be reacting with indignation throughout the interwebs, and admittingly, part of the problem here is those legitimately railing against Sony for refusing to inform their customers of the ramifications right away are being overwhelmed by a far more hostile contingency of X360 fanboys seizing the opportunity to gloat. The latter are just immature assholes, insofar that it's worth noting that if this shit happened to Microsoft instead they'd be the ones scrambling to defend their "precious" X360 against an equally vicious group of PS3 fans, and the PS3 fans would be the assholes. The console wars are stupid, everyone involved in them are stupid, etc.

The fact that X360 fanboys are acting like petulant children at a candy shop, however, does not justify Sony fanboys "retaliating" by accusing everyone criticizing Sony's handling of this lovely little catastrophe of advancing some agenda. I fucking love Sony, but the reasons I love my PS3 have precious little to do with the individuals who work for Sony who are responsible for this fuckup. Most of my love for Sony stems from a combination of third-party developers who work on PS3 exclusives (Naughty Dog, here's looking at you) and the fine folks who actually develop Sony's hardware, in a division or department that I imagine is somewhat distinct from the group that handles security breaches or the Playstation Network, let alone the bigwigs in charge (and in their legal / media relations departments I'd presume) who make decisions as to when to release pertinent information to the public. I love the former. Adore the former. But I'm fucking pissed the shit off at the latter, because they clearly did not do an appropriate job protecting my credit card information, which is basically the single most important thing for them to do, really.

Do I honestly think that I out of all the seventy million PSN customers am going to find money accruing on my account? Probably not. I'll keep a lookout for a bit but I'm not going to lose sleep over it. My credit card has a $1000 limit and in the worst-case scenario I'd call and easily acquire a new card. What pisses me off isn't the fact that this happened (Sony can't control the fact that hackers are assholes) but the lack of transparency.

The minute Sony knew this had happened they had to suspect the possibility that our information had been stolen. They should have informed their loyal customers immediately of the possibility, even when that possibility was not confirmed. The fact that they waited for a week -- a week when someone out there might have been harmed by the hacker's actions in regards to their financial accounts or personal information -- is fucking stupid, and it suggests that individuals at Sony care more about bottom-line profit margins than about actually protecting their consumer base. They wanted to prevent losing money over media hysteria upon conjecture news, even if it meant a loyal PS3 owner out there was about to get smacked down with a hefty bill.

Let me be clear that the hacker owns 100% of the moral culpability for his actions. I hope they find him and give him a nice comfy jail cell to sit in for a while. That being said, Sony could have mitigated the damage and chose not to, deliberately leading us on with vague statements for as long as possible until they were basically forced to confess that, oh, yeah, our information's been compromised.

It's a dick move that shouldn't effect anyone's love (or hate) for the PS3, insofar as I'd personally guarantee anyone that Microsoft and Nintendo probably would have done the exact same things in the exact same situations. The problem isn't Sony, the problem is big businesses and their lust for profit and the manner in which CEOs and Board of Directors and major power players at big corporations operate and the infrastructure that supports their warped decision-making. The entire corporate system was aligned against Sony "doing the right thing."

I won't hate the artists, technicians, writers, and creators who make beautiful hardware and software with Sony's label on it just for getting caught up in the behemoth machinations beyond their control, but it's simply a fact: everyone's favorite videogaming companies has bigwigs in them that are completely and utterly full of shit and that do not have the best interests of their customers in mind, and this was completely evident in Sony's ludicrous botching of this particular situation. As a PS3 fan I can only desperately hope the console and those who develop for it do not pay the price.

[rpgdemon]

I was actually hoping you'd give some opinion on the topic, Snake, just because your rants usually have a basis in reality, and you know the legal stuff better than most people here.

Just to give perspective on my thoughts, above, I actually don't own a PS3, and the only Sony product that I've really played much with is an original PS that my younger brother bought a couple years ago, since it came with Chrono Cross, and the second Megaman Legends game. (I played Megaman 64 on the N64.)

I was rather disappointed in Chrono Cross, incidentally.

[Amake]

Originally Posted by Marc v1.0

There is a joke here.

The joke is using the words "respect" and "corporation" in the same sentence.

Sony is an evil, corrupt and greedy corporation, Bells. There's no arguing that point. It's nothing personal, it's just that they are a large corporation. Even if everything they have done in this situation is in their customers' best interest, they're still doing it because they are corrupt and evil and greedy and want to keep their customers. It's not something we should respect because it's good business and other corporations also do it.

The question as I see it isn't how evil they are, but how good they are at being evil. Specifically, will we still buy their product? I for one am not going to give them my credit card number after this.

[Seil]

I was rather disappointed in Chrono Cross, incidentally.

What did you think of the music?

[Drownball-Champ]

Originally Posted by Invisible Queen

The question as I see it isn't how evil they are, but how good they are at being evil. Specifically, will we still buy their product? I for one am not going to give them my credit card number after this.

Same. I'm just glad I: A) Took my card off of PSN back in November; and B) That card expired. So even if they did get the card number, they lack the new expiration date.

I'll be doing all PSN transactions using PSN cards now.

[Kyanbu The Legend]

Originally Posted by Invisible Queen

The joke is using the words "respect" and "corporation" in the same sentence.

Sony is an evil, corrupt and greedy corporation, Bells. There's no arguing that point. It's nothing personal, it's just that they are a large corporation. Even if everything they have done in this situation is in their customers' best interest, they're still doing it because they are corrupt and evil and greedy and want to keep their customers. It's not something we should respect because it's good business and other corporations also do it.

The question as I see it isn't how evil they are, but how good they are at being evil. Specifically, will we still buy their product? I for one am not going to give them my credit card number after this.

Trying the keep you business afloat is kinda not entirely evil. Besides Sony's more (sometimes lovable)arrogant pricks then evil anyway. That cringe at the thought of mentioning/confessing any mistake they make.

[Doc ock rokc]

I have not recieved any notifications about my info being hacked. Even then I never ever allow any online service to remember my debit card info. Sure it's a pain to type it all in over and over again. However for that extra burst of security it's worth it.