Sony Blames Anonymous For Setting The Stage For PlayStation Network Hack

By Diane Bartz and Jim Finkle

WASHINGTON/BOSTON (Reuters) - Sony Corp blamed the well-known Internet vigilante group Anonymous for indirectly allowing a hacker to gain access to personal data of more than 100 million video game users.

"Sony now faces a large-scale cyber-attack involving the theft of personal information," Kazuo Hirai, chairman of the board of directors of Sony Computer Entertainment America LLC, said in a letter to members of Congress.

"What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes," he added in the letter to members of Congress who have launched an inquiry into the matter.

The company also said it waited two days after discovering data was stolen from its PlayStation video game network before contacting law enforcement and did not meet with FBI officials until five days later.

The theft prompted the Justice Department to open an investigation, officials said on Wednesday.

"The Sony matter is under active investigation. It involves personnel from the FBI and the Justice Department who are looking into the matter," Attorney General Eric Holder said. "It is something we are taking extremely seriously," Holder said.

Sony said that its video game network was breached at the same time it was defending itself against a major denial of service attack by the group calling itself Anonymous.

Anonymous is the name of a grass-roots cyber army that in December launched attacks that temporarily shut down the sites of MasterCard Inc and Visa Inc using simple software tools available for free over the Internet.

The group attacked the two credit card companies with "denial of service" attacks that overwhelmed their servers for blocking payments to WikiLeaks.

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.

The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said.

Sony said it was not sure whether the organizers of the two attacks were working together.

The company noticed unauthorized activity on its network on April 19, and discovered that data had been transferred off the network the next day.

The PlayStation Network had 12.3 million accounts with credit card numbers globally, and about 5.6 million were U.S. accounts.

The company's general counsel gave the FBI information about the breach on April 22, the company said in the letter to the subcommittee on Commerce, Manufacturing and Trade.

(Reporting by Jim Finkle and Diane Bartz; additional reporting by Liana B. Baker in New York; editing by Maureen Bavdek and Gerald E. McCormick)
Copyright 2011 Thomson Reuters. Click for Restrictions

Comments

[waldopepper]

10:13 PM on 05/05/2011

Anonymous will be a convenient scapegoat for many companies/governments/individuals who wish to deflect blame for their own negligence.

[Jon Polm]

05:42 PM on 05/05/2011

"Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco."

Wrong. Sony was not defending itself against a hacker in federal court in SF. They were prosecuting a hacker in federal court in SF. Anonymous was protesting this prosecution.

[Greg Nice]

12:37 PM on 05/05/2011

Sony is lying through their teeth.

This is all a ploy to manipulate political momentum and discredit the the small segment of the gaming community that feels they have the right to modify the gaming consoles that they paid hundreds of dollars for.

Sony's practices and attitude towards these activities are in direct conflict with the recent revisions of the Digital Millennium Copyright Act which specifically state consumers have the right to modify electronic devices (jailbreak/root etc) to run third party software and applications.

Wake up people.

[Kevin Zielke]

06:31 AM on 05/05/2011

Glad I don't have a PS3

[planetjeffy]

12:53 AM on 05/05/2011

A DOS attack (if it even happened), has nothing to do with poor security of cc numbers and personal data. This is the result of an arrogant and lazy company.

[onlyahumanshell]

12:57 AM on 05/05/2011

Yeah, they are trying to divert attention away from their lack of security and laziness.

[planetjeffy]

02:32 AM on 05/05/2011

either credit card numbers and personal data is safe...or it isn't
Sony was too cheap or too lazy (or both) to protect this data. It is pretty easy to do.

[assyrian1138]

12:04 AM on 05/05/2011

Oh get over it. Your CC info is as easy to get as a few clicks. If you're so worried about it use gamecards instead of CCs. Problem solved, now let's drink!

[SDLee]

12:02 AM on 05/05/2011

What the hey are those jerks at Sony thinking, waiting five days to contact the FBI? I now officially hate Sony who let my data get stolen.

[Igor Vovkovinskiy]

11:52 PM on 05/04/2011

LOL Sony will blame anyone who is currently in the media spotlight. Maybe they should spend a few more benjamins on security.

[Hammerlock]

11:30 AM on 05/05/2011

Hell-a few jacksons spent on security would have been an improvement.

[onlyahumanshell]

11:24 PM on 05/04/2011

How did I know this was coming? Oh dear. Someone is "cruising for a bruising". Sony, just focus on good security, restructuring, and releasing great products. You made the mistake and are not free from fault. Stop trying to pass the buck without substantial "documentation."

[dtallwalk]

11:05 PM on 05/04/2011

I wonder if this has something to do with wiki leaks anonymous is there protector
So I have read it is well established that the US would very much like to take down wiki leaks
Because of all of the documents leaked by them. The scandal around the founder
Did not work is this a new attempt to take them down?

[maxben]

11:07 AM on 05/06/2011

Anonymous chose to fight for Wikileaks, but its far from its protector.
Anonymous has a variety of things it does, and the attack on Sony was associated with the geohot fiasco and not wikileaks.

[dntpay4sftware]

10:51 PM on 05/04/2011

I love to watch proof that nature and nurture are intertwined. Japan is attacked on two fronts. First Mother Nature attacks Japan by Tsunami. Cost: $0. Now, humans attack Sony (Japan's Business Giant). Cost: $0. Watching Humans and Earth blind-side a country that symbolizes the myopic greed and arrogance of our flawed, fat, disgusting and money-addicted population -- a population that destroys more humans and more viable earth than any other in history:
PRICELESS!

[jsarets]

09:42 PM on 05/04/2011

There are basically two completely different types of hackers today: one school that is trying to defeat schemes in which vertically-integrated vendors restrict the functionality of their products, and another school which is trying to defeat schemes which protect the privacy and property rights of others.

There is very little overlap between these two flavors of hacker. The former are highly moralistic in vigorously defending the rights of users against oppressive, anti-competitive bundling practices which stifle innovation and should be illegal, whereas the latter are essentially amoral con artists who exploit people for their own selfish gains.

Anonymous was defending a guy who sought to use the Playstation 3 he owned to run the software he wanted it to run rather than that which Sony wanted it to run, a right that Sony had sold along with the device. In any other domain of property law, this much would be thoroughly incontrovertible, but for some reason, computer vendors think they can enforce copyright licenses on hardware (which are never eligible for copyright protection) by bundling copyrighted software.

This other attack on Playstation Network in which user account data was compromised is a totally different kind of hack which belies completely different motives and strongly suggests the work of those who have no organizational connection to Anonymous. At best, the SPN hack exploited the concurrent Anonymous DDOS for its own purposes, behavior which is unsurprising from this school of hacking.

There were two different hacks by two different hackers. One needs at least two if not more brushes to paint the hacker community (which arguably includes another school related to distributed open-source software development projects such as the Linux kernel). One cannot conclude that any two concurrent hacks must have been coordinated.

[onlyahumanshell]

07:44 PM on 05/05/2011

Good read! The hackers involve appear to be of differing make-ups for sure.

[Crim]

09:17 PM on 05/04/2011

I doubt there are many companies that could withstand this sort of focused attack. If you're connected to the internet, you can be hacked. Ask google, or Iran, but I digress, continue to flame Sony.

[maxben]

11:09 AM on 05/06/2011

Apparently Sony did not even have a basic firewall set up.
Could you imagine if Google just left their databases open like that?

[frank day]

09:01 PM on 05/04/2011

I was just waiting for them to claim this.

Total BS.

Blaming others for their own incompetence.

I will never buy another Sony product ever again.

[Baracous]

08:54 PM on 05/04/2011

This story is pure misdirection. Their last attack was not on credit card companies. it was on a security firm tied in with the DOJ. What happened to all of the emails recovered? Why isn't anyone talking about that story any longer?