PSN Hacked, Private Info Stolen

[Kyanbu The Legend]

It seems the numbers were stolen during the 18th and 19th of April. basically 2 days before they took it down. According to some news papers and articles (mainly Yahoo).

[bluestarultor]

Originally Posted by Kyanbu The Legend

It seems the numbers were stolen during the 18th and 19th of April. basically 2 days before they took it down. According to some news papers and articles (mainly Yahoo).

According to the link to Sony I posted a page or two back, it took them a couple days to know anything had happened. They shut down everything as soon as they did.

Like I said, hackers aren't always sloppy about this kind of thing.



Edit:
AND DAMMIT, THE CREDIT CARD NUMBERS ARE NOT WHAT WAS ANNOUNCED TO BE STOLEN!

It's personal info that we should really be worried about.

[Bells]

Just to add up for those who want to keep up with it, Sony placed a second FAQ for this on their blog

Q: Are you working with law enforcement on this matter?
A: Yes, we are currently working with law enforcement on this matter as well as a recognized technology security firm to conduct a complete investigation. This malicious attack against our system and against our customers is a criminal act and we are proceeding aggressively to find those responsible.

Q: Was my personal data encrypted?
A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

Q: Was my credit card data taken?
A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system.

Q: What steps should I take at this point to help protect my personal data?
A: For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well. To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports.

Q: What if I don’t know which credit card I’ve got attached to my PlayStation Network account?
A: If you’ve added funds to your PlayStation Network wallet in the past, you should have received a confirmation email from “DoNotReply@ac.playstation.net” at the email address associated with your account. This email would have been sent to you immediately after you added the funds, and will contain the first 4 digits and last 4 digits of your credit card number. You can also check your previous credit card statements to determine which card was attached to your PlayStation Network or Qriocity accounts.

Q: When or how can I change my PlayStation Network password?
A: We are working on a new system software update that will require all users to change their password once PlayStation Network is restored. We will provide more details about the new update shortly.

Q: Have all PlayStation Network and Qriocity users been notified of the situation?
A: In addition to alerting the media and posting information about it on this blog, we have also been sending emails directly to all 77 million registered accounts. It takes a bit of time to send that many emails, and recognize that not every email will still be active, but this process has been underway since yesterday. At this time, the majority of emails have been sent and we anticipate that all registered accounts will have received notifications by April 28th. Consumers may also visit www.us.playstation.com/support and www.qriocity.com for notices regarding this issue. In addition, we have taken steps to disseminate information regarding this issue to media outlets so that consumers are informed.

Q: What steps is Sony taking to protect my personal data in the future?
A: We’ve taken several immediate steps to add protections for your personal data. First, we temporarily turned off PlayStation Network and Qriocity services and, second, we are enhancing security and strengthening our network infrastructure. Moving forward, we are initiating several measures that will significantly enhance all aspects of PlayStation Network’s security and your personal data, including moving our network infrastructure and data center to a new, more secure location, which is already underway. We will provide additional information on these measures shortly.

Q: Has Sony identified the party or parties responsible for the PlayStation Network hack and subsequent theft of personal information?
A: We are currently conducting a thorough investigation of the situation and are working closely with a recognized technology security firm and law enforcement in order to find those responsible for this criminal act no matter where in the world they might be located.

Q: When will the PlayStation Network and Qriocity be back online?
A: Our employees have been working day and night to restore operations as quickly as possible, and we expect to have some services up and running within a week from yesterday. However, we want to be very clear that we will only restore operations when we are confident that the network is secure.

[Marc v4.0]

Originally Posted by bluestarultor

You're totally missing the point. The credit cards are safe. Your personal info, such as name and address, which can be used to get more info to MAKE credit cards, is not.

That's the danger, here. The credit card solution would be easy to fix, but try getting that many people to move.

There are steps you can take to prevent that information from becoming dangerous to you in the hands of another. Since we know this happened, since we were warned, those actions can be undertaken and the value of the information will diminish.

This was my point.

A later part of trying to get that point across was to say that a case where a guy stole a bunch of raw credit card infor in secret and sold it in secret and was found out later after it had been used isn't comparable to what happened here.

That is still all beside the main point that the moment they knew there was an INTRUSION (April 19th) they should have went ahead a been upfront with their CUSTOMERS about it instead of saying that it was down for "TECHNICAL ISSUES".

They knew about the Intrusion BEFORE they took it down, and covered it with a LIE, because saying 'technical issues, all fine here' when you damn well know it was an intrusion (AND THEY DID WHEN THEY TOOK IT DOWN) is LYING, until they realized oh shit. This does not sit well with some people at all, and makes Sony look really shitty.

This lashing could have all been avoided by a simple "Hey, we took down the PSN today because we discovered that there had been a breach of the network security. We have no exact details on the scope and depth of the breach or the intended nature, we at Sony advise you take the proper caution with any personal information you may have had store in our network."

This could have happened April 19th, when they took it down because they saw it had been compromised.

To echo: It's really not that hard to grasp.

[bluestarultor]

Originally Posted by Marc v1.0

There are steps you can take to prevent that information from becoming dangerous to you in the hands of another. Since we know this happened, since we were warned, those actions can be undertaken and the value of the information will diminish.

This was my point.

A later part of trying to get that point across was to say that a case where a guy stole a bunch of raw credit card infor in secret and sold it in secret and was found out later after it had been used isn't comparable to what happened here.

That is still all beside the main point that the moment they knew there was an INTRUSION (April 19th) they should have went ahead a been upfront with their CUSTOMERS about it instead of saying that it was down for "TECHNICAL ISSUES".

They knew about the Intrusion BEFORE they took it down, and covered it with a LIE, because saying 'technical issues, all fine here' when you damn well know it was an intrusion (AND THEY DID WHEN THEY TOOK IT DOWN) is LYING, until they realized oh shit. This does not sit well with some people at all, and makes Sony look really shitty.

This lashing could have all been avoided by a simple "Hey, we took down the PSN today because we discovered that there had been a breach of the network security. We have no exact details on the scope and depth of the breach or the intended nature, we at Sony advise you take the proper caution with any personal information you may have had store in our network."

This could have happened April 19th, when they took it down because they saw it had been compromised.

To echo: It's really not that hard to grasp.

No, it really isn't, so I don't know why there's an issue with your timeline.


1) data is broken into
2) Sony finds out and shuts down everything
3) they DO NOT KNOW there is any data taken and thus don't admit to anything
4) they find out data was taken and fess up immediately


They may have known there was an intrusion, but they didn't know how far it had gotten in UNTIL THEY ASSESSED THE SITUATION and immediately informed everyone of the relevant info. Could they have announced the intrusion itself? Yes, and gotten people all worked up and had to deal with flyaway imaginations, even more bitching about a lack of info, and a general ruckus that could potentially have been worse than the current one.


In short, they did, by reasonable terms, the right thing. You simply do NOT let imaginations run wild in a crisis. Yes, you do a bit of covering shit up, because that keeps things in control so you can handle them better. When the had useful info, they released it, just like they should have.



Or, to apply this elsewhere. Say you have a cat and put it in a box, then push a button that may or may not release a deadly poison. By the way, this is your sister's cat and your sister is breathing down your neck with a butcher knife. Do you tell her you may or may not have killed her cat by pushing the button and let her stab you 32 times when the cat may still be alive? Fuck no. You check to see if the cat is actually dead. If not, you saved yourself 32 knife wounds by keeping your trap shut and no one is hurt.

[rpgdemon]

You guys, could you quit it? You believe and are arguing two fundamentally different points, and are refusing to change your opinions.

Blue, you think that Sony ought to do what was best for a company.

Marc, you think that Sony ought to do what was best for the consumer.


THAT IS WHAT IS APPARENTLY SO HARD FOR YOU BOTH TO GRASP. YOU HAVE DIFFERENT OPINIONS.

[bluestarultor]

Originally Posted by rpgdemon

You guys, could you quit it? You believe and are arguing two fundamentally different points, and are refusing to change your opinions.

Blue, you think that Sony ought to do what was best for a company.

Marc, you think that Sony ought to do what was best for the consumer.


THAT IS WHAT IS APPARENTLY SO HARD FOR YOU BOTH TO GRASP. YOU HAVE DIFFERENT OPINIONS.

The thing is telling people about what might be a minor issue and getting a mass panic going unnecessarily isn't even beneficial to the consumer. In this case, someone bypassed some heavy security and managed to get into some info from what Sony is saying and I believe them. Big companies like Sony don't leave things unsecured. Depending on their systems, getting into the system doesn't necessarily mean getting into the juicy parts.

If you tell people right away there might be a problem, people take that as "OMIGODTHERESAPROBLEM!" If it turns out there isn't actually a problem, you've created your own problems because everyone's in a froth, and before you go back to the "company" angle, people in a froth tend to stay that way through their own insecurities and the media's playing on them.

In short, if there's no solid info that people should be worried, worrying them and not having good info makes them MORE worried and stressed and that has an impact on their daily lives.

Nothing happens in a bubble, here. What's good for the company isn't necessarily bad for the people. If there's not really a problem, you don't need 70 million people biting their nails unnecessarily for the next month as the media toys with them.



To go back to the cat analogy, putting yourself in the sister's place, if she's told her cat might be dead, she's going to be stressed out over something that may not be true, whereas if she's not told and the cat is fine, to her, nothing ever happened and she goes on happily breathing down her sibling's neck carrying a butcher knife, 'cause that's just how she rolls.


EDIT:
What I'm saying is people are pissed off now, but they would have been even more pissed off if news had been blown when there was even less info. People are already bitching about the lack of info. Imagine several more days of that, and several more days of outright media circus based on conjecture and pundits like Glenn Beck throwing out their theories. That's extra stress in the company and customers both. Sure, people say they would have wanted to know earlier, but given an objective viewpoint, really, this was the better option.

[rpgdemon]

See, the cat analogy is only accurate if we're talking about a cat that fulfills the position of the guardian of your entire household, and financial and personal information. If that cat might be dead, you tell your sister so that she can go put a new cat in charge of all that stuff, instead of leaving it potentially undefended, but who knows so why's it matter?


Like, if you had a castle. You find out that your tower guards might have had their soup poisoned. You're not going to NOT let the other people who might have to fight know, you'll tell them to be on their guard against attack, in case there are no guards.


Just because an analogy is logical within it's own context, it doesn't mean that the analogy is applicable to the situation. That's why I hate analogies, people think that defending their analogy as logical is analogous to defending a point as logical, but the analogy is not the situation.


Edit: People are complaining because they don't have any information, despite it being a week, not because they don't have all the facts. If your personal info MIGHT have been stolen, it doesn't matter if that's true or false, you want to know, and prepare as best you can as if it were. You should always assume the worst possible outcome, so that you're never under prepared. Preparing for the best possible outcome is just silly.

[bluestarultor]

Originally Posted by rpgdemon

See, the cat analogy is only accurate if we're talking about a cat that fulfills the position of the guardian of your entire household, and financial and personal information. If that cat might be dead, you tell your sister so that she can go put a new cat in charge of all that stuff, instead of leaving it potentially undefended, but who knows so why's it matter?


Like, if you had a castle. You find out that your tower guards might have had their soup poisoned. You're not going to NOT let the other people who might have to fight know, you'll tell them to be on their guard against attack, in case there are no guards.


Just because an analogy is logical within it's own context, it doesn't mean that the analogy is applicable to the situation. That's why I hate analogies, people think that defending their analogy as logical is analogous to defending a point as logical, but the analogy is not the situation.


Edit: People are complaining because they don't have any information, despite it being a week, not because they don't have all the facts. If your personal info MIGHT have been stolen, it doesn't matter if that's true or false, you want to know, and prepare as best you can as if it were. You should always assume the worst possible outcome, so that you're never under prepared. Preparing for the best possible outcome is just silly.

While that's true, the media is also over-prepared to make a circus out of anything. People hate not knowing more than they ever hate knowing even the worst possible things. Call it lending a peace of mind when Sony didn't come forth right away with them being hacked, rather than leaving people fretting for days on end not knowing. When they knew damage was possible, THEN they came out with it so people could prepare properly with actual information. In the meantime, the info is unlikely to have been put to any real use. That all needs to be sorted through, then buyers have to be found, and so on. A week is simply not enough time for wide-scale damage to take place, especially from only partial information.

In short, although people feel cheated now, they still have fingernails left and for the most part people are safe. Nothing would have been gained by anyone if an initial hacking announcement had been made. Just more stress.



EDIT: This isn't even coming from me as being part of the industry. This is just knowing how the world works and how people think for a decent part of it. A lot of this is me parking my ass and thinking logically, rather than emotionally. Come to think of it, didn't we just have a thread on that?

[Krylo]

Originally Posted by bluestarultor

EDIT: This isn't even coming from me as being part of the industry. This is just knowing how the world works and how people think for a decent part of it. A lot of this is me parking my ass and thinking logically, rather than emotionally. Come to think of it, didn't we just have a thread on that?