First of all, let's get it clear, any network attack that causes ANY business to shut down for a week or more is very intentional, sophisticated, and severe.
The guys who did this were doing it for money. It was a grand identity theft / credit card theft scheme with some fun IP theft thrown in.
77 Million-ish customer records with nice extra information (Birthdays should be SWEET for helping bootstrap an identity theft effort!). If there is a "Secret Question" with your Mother's Maiden name or some such for password recovery, the information is almost certainly stored in clear next given the poor state of other security features (old authentication server and web server software and perhaps even cleartext password storage according to
Eurogamer with information from hacker IRC discussions several months ago!)
AWESOME.
Get ready for some phun phishing attacks and other scams!
Given the pathetic state of US privacy laws, Sony is likely to only face fines of $0.10 per person or something like $3 Million if the TJX case a couple of years ago (if I remember correctly) is the model (see my
article)... given the 30 Million odd US citizens whose data has been lost. If you are keeping score, the initial estimates were over $1 Billion in fines against, so watch the estimates.
Boy, I'd like to see some REAL identity protection - How about $100 per personal record compromised? That would get companies to spend some money on security and not store every bit of data that they can hoover up.
There are also allegations that the hackers were able to get into proprietary portion of the PlayStation Network and access games that they hadn't purchased.... something Sony is going to be having some interesting discussions about with its publisher and developer partners (not to mention the lost sales from the outage for DLC and digitally distributed games).
The lawsuits were inevitable. A class action suit has been filed against Sony over the network data breach, according to
Information Week.
Very awkward (for Sony, that is). The challenge will likely be to show that Sony has not shown sufficient due diligence in its protection practices at the site. Any lack of documentation, evasion, or what have you is not going to help (ask PG&E here in California). It is guaranteed to be a PR nightmare, if nothing else.
As to the threat of credit card loss, the only saving grace may be the actual number of people who've provided a credit card to Sony (a number that Sony has been very reluctant to disclose).
The cost for responding to the California (and other US state) Data Disclosure laws is likely to be around $1 per person for the notification + the added bonus of paying for a year of credit monitoring (I'm not sure which data breach I got this compensation for)... say $10 per person, maybe less if you get a group discount.
So, we're looking at tens of millions of dollars just to get rolling and perhaps over $100 ($300?) Million to deal with the data disclosures in the US alone.
Europe and Asia have real privacy laws, so there may be more fun elsewhere.
Business losses? who knows... it may be a while before they are taking credit cards.
... and I sure hope they're preserving data as the FBI and others may be more than a bit interested.
As everyone else is warning... it you have a PSN account, make sure you don't use the same password elsewhere, change your secret question answers elsewhere, and watch your credit cards and emails for a fair length of time.
So, is anyone ready to start a pool on how much Sony is going to settle for per person (in the US and globally)?
Sony Sued Over PlayStation Network Hack, http://www.informationweek.com/news/security/attacks/229402362
"
PSN: The Security Scandal", http://www.eurogamer.net/articles/digitalfoundry-psn-security-scandal
"
Fraud body calms PSN identity theft fear"
