Sony agrees to $15M settlement in 2011 data breach class action

Sony today agreed to a $15 million preliminary settlement in a class action lawsuit over its 2011 data breach, which led to the theft of names, addresses and possibly credit card data belonging to 77 million user accounts.

[SpinalRemains138]

Slap on the wrist

[Lightning Mr Bubbles]

Ouch!! Those are $15M that could of been spent on making games dammit...

[FarEastOrient]

The only people making money off of the settlement is the lawyers.

[Kevlar009]

Sony losses hundreds of millions of dollars a year, just another bad day for Sony

[Dirtnapstor]

@FarEast
You're absolutely right. It's pretty pathetic that the system works like that, where as the real beneficiaries are the lawyers.

[Tctczach]

Lol. Millions of cards breached and $15,000,000. That's a wag of the finger.

[DragonKnight]

No cards were breached. All cards were encrypted.

[Tctczach]

http://www.theguardian.com/... http://mobile.reuters.com/a... please learn the difference between breach and stolen.

[fenome]

Not one single person I've heard of ever had anything bad happen because of this, myself included. It was all encrypted data, it never got used. Someone on the inside thought they were cool and took a backdoor key, nobody actually had any $$$ stolen or fraudulent activity. This is all a bunch of bullsh** that people like to troll on.

[pop_tarts]

"led to the theft of names, addresses and possibly credit card data belonging to 77 million user accounts in what is one of the largest-ever Internet security break-ins."

I do believe theft means stolen not breached. Their "network" was breached. Peoples "information" was stolen.

Seems like you should heed your own advice.

[Tctczach]

Breach and "break in" are practically the same thing! Of course they had access to all that info. That's a breach. If you breach a countries defense in war it means you crossed their line and possibly saw their equipment, not obliterated them. So what I was saying since I have my crayons out was they saw your info but did nothing with it. That's a breach.

[Death]

It's not a cash settlement. It's free services, themes, game downloads, etc.

[Darkstares]

I'm not sure what people want for compensation. We have no idea what impact if any this actually had. So how do you put a value to each person who was a member at the time if nothing really happened? What we do know is what we knew all along and that is Sony did not have sufficient security measures in place. Most things can be hacked but they did not do a good enough job at preventing it until after it occurred. In hindsight it was actually a good thing because now we are all more aware of our personal information, Sony beefed up its security and the news spread the word to other companies to improve their own security measures.

[OrangePowerz]

They did offer free fraud protection afterwards to people who had their cards stored on PSN.

Also that is more than what as example banks get as fines. Banks in Germany lost my data more than once because they sent account data to other branches on discs via mail and the discs never arrived and I got zero compensation for that.

Lets not forget most services got hacked in the last few years amd account data got stolen and Ebay was one of the recent examples this year and last year pretty much every ges publisher website got hacked and data stolen. If someone really wants to hack into a site or service and steal data they will get in.

[DragonKnight]

They shouldn't have even agreed to this.

"If you are responsible for so many payment card details and log-in details, then keeping that personal data secure has to be your priority," the Information Commissioner's Office's deputy commissioner David Smith said. "In this case that just didn't happen, and when the database was targeted — albeit in a determined criminal attack — the security measures in place were simply not good enough."

So they agree that it was a determined criminal attack, which means it was planned and studied before hand so as to ensure positive results, yet Sony's at fault because... they didn't predict the future?

Names and Addresses are a matter of public record and shouldn't even be considered in any lawsuit. Hell, google, phone books, the frickin' Freedom of Information act can likely get you anyone's name and address that you want. Where's the government settlement for the millions of people that that affects?

As for credit cards, it's already been stated at length that the credit cards were encrypted. NO ONE's was breached. In the "so slim it's nearly non-existent" chance that someone's card was breached, Sony offered a $1 million dollar fraud protection service to the affected person or persons. Guess how many claimed it.

It's so unbelievably insane that a company can be attacked and end up being punished for that attack.

[chaosx]

Attacked? no! targeted yes , and the servers were not up to date with the latest patches. If their servers were vulnerable, they were not protecting the clients data to the best of their ability, so then blame should fall totally on there shoulders.

In my opinion .

[DragonKnight]

Attacked YES! It says it right in the article.

"albeit in a determined criminal attack."

That's the government's official stance on what occurred. They were attacked, they are a victim, and they are essentially being punished for not being clairvoyant. No service in the world, I repeat and emphasize, NO SERVICE IN THE WORLD IS HACKER PROOF!

[JD_Shadow]

Probably should've tried to do more instead of pretending that it could never happen to them, then suddenly say "oh, poor us". They should've been more upfront with consumers about what was exactly going on (I can understand not giving TOO much info away, but it was trying to infiltrate the CIA the way they were sparse in giving out any info as to WTF was going on).

I like Sony as much as the next guy, but that doesn't mean I'll let them off the hook when they do stupid shit. Nothing is hacker proof, of course, but they obviously didn't think things through enough. Hopefully, lesson learned on both ends.

[Darkstares]

They were fined for not have proper security measures in place. Why is this so hard for you to understand? You go on and on about how it's Xbox fans making a big deal out of it when in fact it was PSN users who were most upset. Sony even admitted their security measures could have been better and guess what? They did indeed make it better because of it. Why do you think Target customers were upset? Would you not get upset if your bank called and said your information was compromised only to find out every other bank but yours was offering much more advanced security measures or would you blame Xbox fans for that too?

So take your issues with Xbox, Xbox fans, Microsoft and everything else you have all bottled up inside for years and start acting like a consumer for once. Honest;y, is Sony paying you because you sure act like it's your job doing damage control for them all while attacking the Xbox, Xbox fans and Microsoft any chance you get.

[Yahdaree]

I can't believe the world we live in.

[mrpsychoticstalker]

Damn Sony, there goes the Money I spent buying games twice regular edition and ps4 edition. :(

[user7402931]

awesome!

[Dudebro90]

That's it? What a joke.

They lost 77 million peoples private data, and then are given a punishment that will not teach them or any other company the importance of private data security and protection.

[TheWackyMan]

They got your name, and where you live. At this point, that really isn't all that private, since millions of people could just find that out with a simple google search.

@gamerfan0909 with a simple google search, you could also find out that they never actually stole any credit card information. The internet is a truly wonderful place.

[gamerfan0909]

Name, address, CREDIT CARD INFO. That's enough to mess over a ton of people.

[Death]

Sony didn't encrypt any of our data including the credit cards we used on PSN. So the hackers have your name, address, phone number and credit card numbers. You can't make it much easier for identity theft.

[rainslacker]

The credit info was stolen, but it was encrypted so it couldn't be read. The rest of the information was just name and address info, likely phone number or something. Everything that would be easy to find on public record unless you go through extremes to keep it private, which most people don't. Most of the information that was stolen is likely already sold many times over by any number of companies that keep track of that information anyhow.

[SilentNegotiator]

There was never any evidence of useable CC data being stolen, just the basic info. But shocker, that won't stop Gamerfan####/Gamefan####/ Gameon####/etc#### and Death from claiming that it TOTALLY DID GUIS.

[trouble_bubble]

@death
My name address and phone number are already public. It's called a phone book. Paranoia much?

I wonder what my yellow pages could go for on the black market? Bidding starts at half a million..

[DragoonsScaleLegends]

Taking money that could be used to help fund better security will make it worse.

[FarEastOrient]

The company lost money and the hackers didn't lose anything.

[emad-E-three]

Speaking like they hacked there own network -_-
They are the Victims!! You know what just GTFO!

[DafunkyRebel]

The NSA already knows your Social Security, Credit card, address, likes and dislikes and your habits. So yeah Sony is only small time compare to your government.

[hiredhelp]

That's it? What a joke.

They lost 77 million peoples private data, and then are given a punishment that will not teach them

Eerrrr. They learnt Alot from this they also spent out millions more investing in better security. Inc better servers and free games to gamers and public appology And cost of trying track down the hackers.

[DragonKnight]

They actually completely moved the location of their servers and hired completely new people after the PSN hack. That's why it took a month for it to come back up.

[hiredhelp]

Sorry yes they moved servers late night. Eaither way cost them millions thoes disagreed do your research.

[incredibleMULK]

Thats what they get for doing their business with sony. If it was microsoft they couldve sued them and won in american courts. You can sue government agencies in America and WIN. Japanese courts ain't gonna clobber their own company...sony and nintendo are their work horses.

You were lucky to get dead nation and infamous for your personal data breach. "Heres twelve dollars in old games now be gone."

[sungam3d]

That's like 20 cents per person...

SCORE!

[Sitdown]

Haha...only if rounding up, which I'm sure they won't.

[chaoslh]

its probably the same people that hacked it

[kaileb]

So if my wallet is stolen in the mall, I can sue them for not protecting me and my wallet? And I can sue target store when they got hack too??

[gamerfan0909]

I read this wrong. You can't sue the mall for you being careless with your wallet or a thief happened to be inside of a mall.On the technology end though, a company as big as Sony or even Google or IBM for that matter should not be getting hacked at that level or if they do get hacked they should be able to defuse the situation quickly. Then the cherry on top was them not announcing the hack for a couple weeks when peoples card info was vulnerable.

[ThanatosDMC]

Yeah, messed up since they were the ones attacked.

[SpinalRemains138]

Yeah its not like it was their responsibility or anything.

:/

[yewles1]

Remember the Citi hack a month later by a different group that actually made out with $2.7 Million from peoples' accounts? NO ONE BATS AN EYE!!!

[MajorLazer]

Apples and Oranges

[Death]

If you went to the mall and they required you to hand over your wallet while shopping and left it on the counter for anyone to steal, you'd probably have a case.

Sony not only left our info out on the counter since they didn't use encryption, they also neglected to tell us in a timely matter so we could take measures to prevent unauthorized access to our accounts.

[rainslacker]

You need to stop spreading misinformation. The credit card info WAS encrypted. The hackers said this themselves, and that they couldn't decrypt it. Sony let users know two days after taking down PSN what was happening. I remember getting the email before I even realized they took down the PSN. Sites didn't even know that the take down was intentional due to the hack until Sony did this, which happened after people started getting contacted.

In that email, Sony let people know exactly what was taken. Name and address information. They admitted that CC information was stolen, but that it was encrypted and unreadable without the decryption keys. They also gave assurances that they were setting up a contract with a credit protection company and would give us the information as soon as possible. Every single person affected by the hack got a year's worth of credit protection, which wasn't even necessary, since NOT ONE SINGLE PERSON had their identity stolen from this hack.

[OrangePowerz]

So if their data was not encrypted how come we didn't hear from thousands of people that they lost money (myself included since I had my credit card saved on it)?

Sony offered free fraud protection to anyone that was registered on PSN to prevent any wrong doings from whoever hacked the service.

Also none of the conpanies send out a press release directly when they get hacked, there are other steps they first take before informing the public such as investigating what happened, what was stolen and if possible closing the door the hackers came through. If you directly announce you got hacked others will immediately try to hack you as well and try to find the door inside. Plus the hackers might share the information on how to hack the company so others can get in without problems as well. Letting everyone know there is a hole in your security isn't the first step you should or want to take.

[DragonKnight]

Xbox fans have been spreading this FUD for 3 years and they won't stop. The CC info was encrypted and I too received the email. It told me that my information was possibly compromised and that I should change all of my information immediately and consider contacting my bank as a precautionary measure (better to be safe than sorry) but that the information was unreadable due to encryption, just like rainslacker said.

I'm not about to blame Sony for being victims of a planned attack on their network. It's like blaming an innocent bystander for getting bombed during a war.

[Death]

Please send proof other than Sony saying the CC info was the only thing encrypted. You also need to back up "not one single person had their identity stolen". According to the Department of Justice, over 7% of the U.S. population are victims of identity theft annually. You really want me to believe not one person whose information was compromised were victim of identity theft?

Misinformation is what you are spreading. A court of Law sided against Sony for their mistake. You can explain and apologize it away all you want, but the courts disagree with you. Statistics are against you also.

[DragonKnight]

"Please send proof other than Sony saying the CC info was the only thing encrypted. You also need to back up "not one single person had their identity stolen". According to the Department of Justice, over 7% of the U.S. population are victims of identity theft annually. You really want me to believe not one person whose information was compromised were victim of identity theft?"

WTF?! Come on now Death, tell me you didn't just say something so ludicrously stupid that it could have come from MisterXMedia. You're an Xbox fanboy, but you've never gone full retard like that.

I can't believe you'd try to use a DoJ statistic that applies to a country of 300 million people and covers such broad parameters to claim that that identities were stolen from a closed network. That's frickin' the height of desperation on your part man. Bad form Death, bad form.

"Misinformation is what you are spreading. A court of Law sided against Sony for their mistake. You can explain and apologize it away all you want, but the courts disagree with you. Statistics are against you also."

Now it's time for you to prove that people had their credit cards compromised. And a settlement isn't the courts siding against Sony, it's Sony choosing to end court proceedings to stop bleeding money into a pointless case like this.

I find it incredibly sad, yet completely expected, that the best proof available is the proof you reject.

[OrangePowerz]

Death. If I remember right the court of law also agreed with Apple that rounded edges should be only used by Apple and that Samsung is in breach of whatever bullshit Apple came up with or that if you spill hot coffee on yourself you can get millions becaise you didn't you the coffee was hot. The american court of law is a joke outisde of the US because you can sue for anything and win. Anyway Sony settled so there was no court judgement.

As for proof of data being encrypted. Sony are the only ones holding the data so how can anyone besides of Sony proof pr disproof that the data was not encrypted? If the data would not have been encrypted we would have seen a ton of articles and news reports of people getting money stolen ftom their accounts.

[SilentNegotiator]

"Please send proof other than Sony saying the CC info was the only thing encrypted"

Sony; guilty of losing your CC data until proven innocent. /s

[Death]

It's interesting that you dismiss the Department of Justice statistics on identity theft. 7% applies to all U.S. citizens. This means 7% of PSN users were affected by identity theft according to the DOJ. Of those 7% we have no idea how many were related to the hack. How anyone can claim not 1 person was affected by the hack is beyond unreasonable.

Sony took 7 days from the hack to letting customers know. This is what they told to Congress during the inquiry. At that time they said they were unsure if the credit card information was stolen. http://kotaku.com/5798492/s...

Spreading fud? The 19th to 26th was more than 2 days. Sony told congress they weren't sure what information was stolen. It wasn't until a month later they released a press release stating the CC numbers were encrypted. The email they sent out did not indicate the information was safe. If anything it was the opposite.

"On April 26 Sony notified users that personal information had been taken and that they could not rule out credit card theft"

So what you are saying is it took more than a week of forensic analysis for Sony to realize they encrypted the data? Makes perfect sense. You would almost think it would have been a good idea to inform congress of this during their inquiry instead of dodging them as long as they did. If you think I am the idiot here I sincerely wish you luck with your future endeavors.

[insomnium2]

@death

LOL the court sided against Sony now? AHAHAHAHHAHA!!!!

7% of the US....wait what? PSN has an istall base of what in USA? I can almost guarantee that atleast 2/3 of the users of PSN are not from USA. Your ramblings are just hilarious.

Man I can't believe anyone would actually say something so ingnorant as "A court of Law sided against Sony for their mistake". That's the epitome of ignorance and fanboyism.

[Death]

LOL, the information is there. You just need to look.

"Sony still hasn't determined whether credit card information was stolen, but they did say that of the 77 million Playstation Network and Qriocity service accounts, about 12.3 million of them had credit card information on file. Of that, 5.6 million were from the U.S. and the rest abroad." http://kotaku.com/5798492/s...

That is 5.6 million from the U.S. that had their credit card information stolen. That means 392,000 of them were victims of identity theft in some form that year. How many of them were related to the hack are unknown. This is unless you think the Department of Justice isn't real and the statistics they release don't apply to Playstation gamers because people are afraid of their domination.

"I can almost guarantee that atleast 2/3 of the users of PSN are not from USA. Your ramblings are just hilarious." -Insomnium

Haha, that's a good one. My hilarious ramblings are coming from what Sony told Congress. 12.3 million credit cards with 5.6 million from the U.S. That would be just over 45% or just under 1/2.

[DragoonsScaleLegends]

All company's are hacked all the time. Target just lost all of there users credit card information why are they not getting sued. I think only people who actually lost something should get anything which is probably no one.

[gamerfan0909]

If I give you my personal bank info and you make a pledge to keep that info safe and then my info gets jeopardized, then yes that's a big deal. The trouble people have to go through to protect their accounts after something like this is a pain in the ass.

[DragoonsScaleLegends]

Yeah but still no matter how hard you try to secure your shit it still can be hacked. I understand sony was lacking in that department with upgrading there security but even now it could be hacked if someone was talented enough.

[dragon82]

The pentagon has been hacked.

You can never fully eliminate the risk of hackers. For every network security person out there you have someone even smarter than them waiting to hack the systems put in place.

[rainslacker]

While I agree with you in principal, the information stolen didn't affect anyone's life or finances, except not being able to play online for a few weeks. The only information that was stolen that was usable was already public record information.

Sony should have been more secure in their data management for sure, but I have yet to see one credible account of anyone who can say that this hack caused their identity to be stolen.

Anyhow, I don't disagree with Sony being held accountable for the lack of security, as it should have been harder to get that info, but too many people act like millions of people were really had their financials ruined due to the hack.

[Deadpoolio]

Ahhh I just love the completely brain dead ignorant people...Hate to tell you this skippy BUT....IF a hacker wants to steal information, it will get done...The god damn pentagon has been hacked, all it takes is alot of trial and error and patience.....

Funny how quickly though those same brain dead Xbots, forget that Microsoft let people lose hundreds of actual dollars from their bank accounts, due to their inability to protect people's XBL accounts during again the YEAR LONG Fifa debacle....

ZERO people were financially effected from the Sony Breach...Yet Micro$oft not only lets hundreds of people lose hundreds of dollars, taking months to get straightened out. The come out and blame their customers using weak password excuses. Knowing the cause of the hacking came from the FACT that they gave people unlimited attempts to guess an account password...

Even a retarded 2 year old knows there is a reason why EVERY site on the planet gives you 3-5 attempts then locks the account....It doesn't matter how "strong" you think your password is, a brute force program will figure out ANY password, especially when you get unlimited attempts....

I can't stand ignorant people when it comes to networking and computers...People who don't know what the hell they're talking about shouldn't even speak in a conversation about it plain and simple. I could google search someone and get the same amount of information stolen from the PSN breach...CC info WAS FACT encrypted...But doesn't change the FACT if a hacker wants into something bad enough they will get it done..Nothing is safe, if you think it is then you need to get off the grid completely

[just-joe]

They kind of dug themselves into a bigger hole when they didn't even admit to being hacked until a week after.

[Chrono]

So we'll get another free game

[ScorpiusX]

You won't be getting a new game but will be seeing a price hike somewhere to recoup that 15 million. Lol

[dragon82]

I doubt it

[tiffac008]

Price hike? Nah! More buildings will be sold because of this~ ;)

jk (please don't burn me to death -.- )

[insomnium2]

@tiffa

That "joke" is so lame it's really hard not to burn you at the stake for it. If you were someone I know I'd drive to your house and slap you for giving intelligent people a headache.

[Neixus]

Yes, they said we can choose to have a free game or ps+ membership.

Also, if your credit card info got stolen, and have proof of it, you get 2500$ from Sony.

[DragoonsScaleLegends]

77 million user accounts. 60% or more probably were not active anymore, 80% or more probably did not have credit card information, and less than 1% or none lost any money.

[rainslacker]

Not a single person lost money due to the hack. The credit card info was encrypted and unreadable. The people who did the hack, and stole the information did so to prove a point, not to distribute the information. Sony has been pretty up front with what exactly was taken, and while they didn't make it public right away, they did inform every person affected by the hack with what exactly was going on. It didn't even take that long for them to do unlike what some people say.

[CaptainObvious878]

Does anyone else find this slightly BS?

Sony took reasonable steps to secure customer's data. They encrypted the credit card data. As far as we know not a single person lost money over it (except sony of course, it cost them millions) and yet Sony are treated as the bad guys.

Sony was the one that was hacked, they were the victim yet they get sued.

There isn't a network in the world that is 100% secure. It's disgusting.

[tiffac008]

I understand what you mean but this is fine. Companies should still be accountable for securing their customers information.

Besides things like this helps as a reminder to every company to continually improve and better their security.

[DragonKnight]

"Companies should still be accountable for securing their customers information."

Which is exactly what Sony did. The hackers were determined to break the security, it's not like the security just wasn't there. If there were no security then the CC numbers wouldn't have been encrypted and EVERYONE would have lost money.

[tiffac008]

When you get hack then you didn't do a better job. In the world of security "NOT" getting compromised is the only important word.

In any case this has been a positive for Sony since their network infrastructure is way better than before.

Besides I'd rather have a company that was honest that they were hacked, took whatever punishment they were given and recover with better security and service. (Sony is not alone in this I'm sure)

So I fail to see why people are so defensive about this issue when all the negative affects have come to pass.

[insomnium2]

@tiffa again

You are not safe ANYWHERE on the internet. Even on N4G you might get hacked and all the info you have given is breached to the hackers. Better get of the grid completely.

People are defensive because there is plenyof evidence that Sony indeed had security measures in place since noone has lost any money over this.

Should Sony have had a better system? I don't know but one particular guy says "yes" and off to the court of law they go. Now instead of loosing 20-50 million and up during the trial BS they CHOOSE to take what seems to be the most likely smaller hit and skip the trial. It doesn't matter really if they'd won or not. It's only 15 million. Had it been 100 million it would've been a different story.

[tiffac008]

@insomnium2

I never discounted the fact that anyone could get hacked but everyone is discounting the fact that this type of situations is actually good in the long run. Its a reminder that everything can be improved and become better.

Like you said no one money was stolen except for Sony paying a small fee for damages. So if people can't see the silver lining in all of this then I have nothing more to say.

Oops sorry Cap I was meant to reply on my own post hahaha. ^^;;

[insomnium2]

OK I can agree to that. As a reminder it is a good thing. The breach was a big one concerning over 70(?) million people /acccounts but all they got was a bunch of useless info hence there are no victims so if this needed to happen to someone as a reminder I'm glad it was Sony. Someone else might've lost our cc info also and the criminals would've gotten money out of this.

I'm sure Sony would've had a better use for that 15 mil though....

[tiffac008]

Well 77 Million accounts was dubious to begin with because that is more than the actual sale of the PS3 at that time. So mostly were useless dup accounts. (I had like 2 at that time too. lol!)

I agree that the $15M could have been added to a AAA game budget though ^^

This is my last bub so thank you for the civil discussion :)

[Provolone24]

It makes me chuckle that people still make a big deal about this. It's obviously nothing to be taken lightly, but I really don't think many people lost much. When I see people like "BUT OMG UR CREDIT CARD BRO" I'm just like "you do know it's not hard to monitor your card info online, right?" If I had seen suspicious activity on my account at the time, I'd have called my bank and taken care of it. Annoying? Sure. The end of the world? Hardly.

I don't think the breach itself was as bad as Sony handled it. Leaving your fans in the dark for days not knowing why PSN was down; now that wasn't cool. Other than that; shit happens. No company is perfect.

[RoseSapphire]

I don't understand this settlement at all. I don't feel Sony owes anything further than the steps they have already taken. They were targeted by criminals and because these hackers were successful, Sony has to pay us? How does that work?

I don't care how good your system is, if someone is determined enough to get in, it's going to happen.

[gamerfan0909]

It's always funny to me when people have such blind alligence to a company to where they can't fault it. The best argument here is " well dude that hack only exposed customers information that could be found on the internet brah, so what if that info was compromised!!!!." When you see arguments like this, it just makes you shake your head. Companies get hacked, but this hack compromised millions upon millions of peoples data. This wasn't some small hack, this was a major security flaw on Sony's part that was exploited. I'm not gonna bash the company because I think they've done a great job making up for the mistakes of that incidence and I feel they've owned up to the mistakes. But for people to legit shrug it off like it's no big deal just shows how far people take brand loyalty.

[stripe814]

oh well even if how strong your security is if the hacker really wants to infiltrate and get what he wants he will succeed, maybe not today maybe tomorrow..Sony is just happen to be the victim and they do admit their mistakes. just sad if only this $15Million was paid to get Crash and Spyro back..

[Ryan741]

Lol, they have no chance in seeing that money, Sony are flat out broke.

[XiSasukeUchiha]

Ouch this hurts Sony!

[SynestheticRoar]

What's sad is most of that money, going to lawyers pockets.

[MultiConsoleGamer]

Just what they didn't need at this point, another major financial loss.

[xkevmandc]

and another, financial loss,well say goodbye to Theo's PS4 sale's lol