GamePro Editorial: Sony's Astounding Breach of Trust

GamePro: "We all knew the dangers when putting our information online, but Sony's failure to warn us about the potential theft of personal information for a solid week is a grave breach of trust.

The fact that Sony waited a full week to inform users is an astounding breach of trust."That's a seven day window," said John Yulzheimer, who is a Credit Expert Witness in addition to President of Consumer Education at Smartcredit.com. "Identity theft rings certainly don't need that much time."

In a situation like this, Yulzheimer told GamePro, the best strategy is "overt disclosure as quickly as possible" so that customers can take the proper steps to ensure the security of their identity, such as placing fraud alerts on credit card information. Instead, we're all left to wonder what has been happening to our personal information for the past week."

[Ace_1975]

Sony have really pissed off a lot of people. This must be their worst nightmare

[the_best_player]

All will be fine, I wish everyone would stop CRYING

[blahblah]

shit, someone got my fake name, temp created e-mail that doesn't exists anymore and fact that i live in west wing of Buckingham palace

in other news, you got to be pretty naive to trust your real info like credit card to online service. and even if they need to do that, they should get informed and use prepay debit cards.

in the other other news sony can't piss me off anymore, they did that with otheros removal. that was the moment when they lost me

[yess]

The first thing i did thursday was to contact my bank, telling them to keep an eye on my credit card cause there might be a risk because of this hack, and they agreed, i didn't wait.

People should have reacted by them self, instead of waiting.
So my boat is floating cause of that, i feel sorry for those who are sinking, but still i would say calm down and talk to your bank and it will be ok.

[RAVEN81]

Sony didn't wait a week, they need to find out that it happ first and see what the hackers stole .

[gamingdroid]

Exactly!

The breach of trust did NOT happen with the delay in response (albeit they could have been faster). They have to conclusively determine what happened and that takes time.

Instead, the broken trust came from the level of intrusion and the sort of information the hackers obtained!

edit: @Bigpappy
You can't release information until you know what information to release. You don't want to alert people and have 70+ million users cancelling and asking for new cards when that isn't necessary.

[feelintheflow]

Actually gamingdroid, yes thats exactly what they should have done. As a retail store manager, we had a employee take a bunch of credit card data from our system, and our lawyers told us if we had not informed the customers as soon as we knew something was wrong, then we would have been on the hook with the credit card companies for the charges incurred. It was their responsibility to inform their customers as soon as there was any breech of security. Period. It is their fault for not informing, not for the hacking, but as with a car accident, it is the person that had the last chance to avoid the collision who ends up being responsible.

[gamingdroid]

Your retail situation is different. You "knew" credit card information was lost.

Sony isn't sure. As an IT professional I know these sort of thing isn't something you just determine within 5 minutes. With a large system as Sony serving 70 million people, it would take a little longer to do forensics.

They should have waited until they knew all the details then release all the information at that point in time.

[Bigpappy]

Are you people from a different planet? Whether or not info was stolen, it is Sony's resoponsibility to let users know of the posiblity. It took them a while before even admitting that they were hacked. It would have been fine if the hackers just brought down the network, but when people's personal info is at risk, they need to let them know about it ASAP.

They need to hope and pray that the hackers did not get a hold of and use someones personal info. Sony could be headed the way of a huge class action law sue, if just one person can prove that their info was stolen due to this hacking. The negligence alone, is enough for a conviction.

The loyalist here are really sick puppies. How could you say that it is the hackers fault for Sony not letting you know that your info might have been stoolen from them? Are you saying that the teives should leave you a note saying how they got into your home and how much they took. Even worst, some guys broke into the girl school where your dauther is a boarding student. The school call you 3 day later to tell you, they had her in the bathroom for 3 hrs, but are unsure if there was a rape.

[Dead_Cell]

And do you know the best bit? Sony sold access with every PS3 sold. So congratulations on hiding the key to 50+ million peoples information in every 50+ million PS3 currently sat in somebodies house.

This couldn't get more embarassing for them.

[blahblah]

actually, no.

speaking as one who lives from maintaining servers.

if you are admin with any sense of self respect and decency
1st duty is being fair and inform customers about worst possible results so they can react proactive against them.
2nd is protecting what can be protected and
3rd is either solving the problem or rebuilding complete system

waiting silently is simply hoping there was no real issue and trying to avoid bad publicity. really immature, but unfortunately companies prefer this option much more than perfect one. no one in right mind could say any other big company would be any better

[lee_ten]

Bigpappy; you don't know how to run a company so i suggest you take a back seat. there is a reason why sony did not leak this information. they themselves *DID NOT KNOW* the extent of the damage so what the hell would they report?

i applaud sony for taking the system down immediately before it spun out of control.

Strikepackage Bravo: and you're bashing sony without getting the acts straight, am i not right? you yourself don't know how to run a company so take a backseat as well. sony did not know the severity of the situation. what the hell were they going to report if they didn't know the extent of the damage that was done? you're another biased individual who would rather nail sony to the cross without learning the facts first. no one is defending sony blindly. they're using common sense...something that you seem to lack.

[Strikepackage Bravo]

Unbelievable, we STILL have people trying to defend Sony, unreal.

So does this mean that MS gets a pass now for not admitting the RROD right away, because they had to be sure there really was widespread damage? See they didnt know exactly how many people were effected by RROD at first so does that makeit OK that they denied the problem initially?

None of you PS3 fans would say it was OK when MS did it, and its even worse in this case of Sony doing it because the stakes are much higher.

And MOST companies would have come clean about a security breach like this because it could cost them more if they did not, we know this because we have seen large companies come forward after breaches before, at least American companies do. Perhaps in Japan the thng to do is keep it all hush hush as long as possible to save face or some crap,financial security of the customers be damned.

[blahblah]

on which planet??? you can expect that from oss maintainers, you can expect that from small companies... but... not from companies like sony, amazon, microsoft. they simply care more about them selves than you. they are in it for the money in the end. and the shitstorm they get from bad publicity kinda makes me feel more understandable.

lee_ten: "i applaud sony for taking the system down immediately before it spun out of control."

in case of breach, immediately is already too late. you've already been hacked, meaning everything is already out of control. it is kinda like starting to put winter tires on your car while skidding out of curve on ice. then again, i completely agree that closing was best reaction possible.

p.s. ever since otheros removal i really, really dislike sony so it is kinda hard for me to defend them here.

[Bigpappy]

You are correct. M$ should have done a recall if they knew that the problem was going to be a huge as it ended up being.

Having said that, this is a much bigger issue than having a $400 - $600 system die on you. You stand to loose alot more than that when people just have your Name address and last 4 off your Social Security Number. Notice I did not include credit card info yet. Just having basic info like that can lead to people setting up accounts and buying themselves expensive item on your behalf. Some creditors may absorb the lost, but you might have to spend some good money trying to avoid your credit being completely destroyed. We are talking not being able to do basic things like, buy a home, rent a car, getting a cell phone that is not prepaid ... This is serious stuff.

I respectfully disagree with you "gamingdroid". It cost those 70Mil people $0 to get a new card # and the oportunity to get fraud protection, if they don't already have it. They are ways to protect yourself if you are told about this stuff early. People were assuming that they had nothing to worry about, because they thought Sony would have said someting if the posibility was there.

[DragonKnight]

*Sigh* WOULD YOU JUST LET IT GO ALREADY?!!!

How many times does it have to be said and seen and slapped in your face that NO COMPANY will be completely transparent about security issues, and that in fact saying anything at all could have caused future problems for them?

For goodness sake, can we let this go? Seriously, this is worse than Anonymous articles now.

**EDIT** Also, how is Sony supposed to inform people of this if they weren't sure what was attacked in the first place? They needed to be sure if the CC info was even accessible in the first place. Why create mass hysteria over something that may or may not have been an issue? Geez. This is like the launch of the PS3 all over again, the media is quick to fan the anti-Sony flames all too easily and get everyone pissed off for something that can always easily happen to any online service. People need to chill the **** out.

[Gothdom]

for some reason, since 2005, the media has been on Sony's bum as if they were the most evil company.

yes, it is not something to be taken lightly, but I personally think Sony took the right steps.

You can't do more than what is said on their blog if some info were stolen. These things happen. I hope that the person (or group of people) that caused this are found and sued.

[DragonKnight]

They did take the right steps. By shutting down the PSN they completely cut off all access from any outside intruders and protected millions of people from the possibility of identity theft and fraud. If they send out a message that says people are possibly affected, it's only because they didn't get to the problem in time, but they can't be sure. They are giving people the chance to protect themselves even if there isn't an issue at all.

They could have easily said nothing, and kept it going, and people would have had their accounts compromised and all kinds of havoc would have ensued.

[Gothdom]

not only that but they involved another company to help them. The professionals did their job and sent the report to sony which then posted the results on their blog. These things take time.

Some people seem to forget these things aren't instantaneous.

[DragonKnight]

Agreed, hiring third party professionals was a smart move. And is also another explanation for their lack of one. They would need to wait for the report, and such a report takes time.

[Dart89]

Finally someone with common sense bubs+.

[UnNaTuRaL1]

You really think sony did the rite thing in this situation? They didn't warn anyone for a week on what might have possibly happened. You always prepare for the worst and they left us in the dark not knowing what was going on. They could of let us know psn was breached and they are looking into the situation that we may need to contact credit card companies to guard against this type of thing. Now a week later you me or anyone else that had credit card information on there could have already been completely f'd over financially and not even know it was happening. I can't believe all of you are defending Sony when your information is in god only knows who's hands!

[DragonKnight]

*Sigh* Here's another person who ignore the obvious and touts out "Sony didn't tell us."

Fact: Sony stated that there was an outside intrusion on PSN. THAT IS TELLING US THAT SOMEONE ACCESSED PSN WHO WAS NOT ALLOWED TO ACCESS PSN!!

A dictation of common sense: It is feasible that Sony required time to analyze every facet of their PSN network to determine exactly what was breached and to what extent. Therefore, what would be the point in telling people information they didn't yet have? Hmmm? Can you answer that? No? Didn't think so because you're not thinking.

If Sony came out and said, without having even the slightest reason to suspect that this is so, that people's credit card information was compromised do you know what would happen? This is what would happen, what's happening even before this CC situation came up. People raging and demanding this that and the other, shareholders for Sony would sell their stocks FOR SURE, and Sony would be in HUGE financial trouble.

Sony need to make sure of what they were going to tell people was even remotely feasible and accurate before they said anything. They have the responsibility of honesty first and foremost. So yes, keeping silent until they had something substantial and accurate to say, and shutting down PSN was absolutely the right move.

[lee_ten]

THANK YOU, EXACTLY.

thank you dragonknight for being one of the few people with intelligence around here. to bad that people are so quick to mash the disagree button because your remarks doesn't suit their agenda.

[DragonKnight]

Meh, I don't care if people hit the disagree button. It merely means they disagree with basic common sense and logic in favor of joining the bash train.

[sleepy3]

Yeah its like the nuclear plant in japan WAITING TILL there is a fireball in the sky to tell people that they MAY have a problem with the reactor after the tsunami.

NOOOOOO. As soon as there was a sign of a problem they informed people IMMEDIATELY!!!!!. That's what you do. Doctors don't wait for a football sized tumor to tell a patient he thinks they may have cancer, as soon as they see something out of the ordinary they TELL YOU IMMEDIATELY.

Even MS who are a terrible with security, lets face it, warn people when they find exploits and say what can POTENTIALLY be done with them REGARDLESS of if some hacker has taken advantage of it.

This crap about Sony being right to not let customers know about a potential theft of CC #'s is insane.

That's why its called a warning. It warns you of a POSSIBLE THREAT. And the fact is that the system was hacked and they knew of a possible threat and didn't tell anyone. That is wrong. They should have warned people and if it turns out nothing was taken, then say so.

[Seraphemz]

Is everyone sure that they knew right off the bat that they had our credit card info.....or did they JUST find out and let us know as soon as they knew?

Oh, and from what i read...it was POTENTIALLY possible that credit card info was stolen.
Im not pissed. If I saw charges that I didnt make, i call my credit card company and they put the money back in.
If anything i feel better that SONY are taking their time to make the system absolutely secure.

I wont be adding my credit info again...lol.. but at least it wont likely be hacked again. I have yet to try socom online...

[gamingdroid]

"I wont be adding my credit info again...lol.."

Ironically, your credit card number is probably safer at Sony now than most others. It's like MS' RROD on the Xbox 360. You betcha they won't be making that mistake again.

[blahblah]

yep, now that psn is closed. information is safest possible.

in real world, breaches happen no matter who controls security. be it sony or someone else. there is simply no 100% guarantee on that. writing perfect code for complex thing like PSN service is practical impossibility.

best sony could do for security is to finally allow paypal and debit cards as payment methods. you simply put money on account, spend it asap and nothing can't be stolen even if your info leaks.

[Pixel_Enemy]

I feel betrayed. As a Sony fanboy, I feel this was handled poorly. We should have know this from the start, so we could change passwords, cancel credit cards and so on.

To all the disagrees that come from Sony fans.. All I want is to be informed of what's going on. Sony has been mum on the whole thing. How can you disagree with that?

[RAVEN81]

well for the first couple of days they were trying to find out what happ.Don't blame Sony, blame hackers

[sleepy3]

At the end of the day, Sony is responsible for the security of its cistomer's info. The hackers are wrong, and i blame them too, but Sony should have been more proactive and constantly be checking their security.

All the hackers proved is that Sony's security has a big hole in it. One which Sony should have seen a long time ago.

I hope you don't think the same of airport security. I would much rat5her they are proactive and think of ways the system can be exploited than just sit and wait for planes to be bombed THEN fix the security holes.

[radphil]

@sleepy3

Ok...you do realize that identity theft and hacking happens everyday.

You know the whole cause of this was the key list that was leaked a few months ago. It started ALL of this.

Plus how the **** can you say a company sees holes in it's security, when you see articles everyday about how "X" thing was hacked. If companies were on top of things, hacking wouldn't exist in the first place....

Also it's ironic you speak of airport security. The main reason why they stepped it up was BECAUSE of the act that happened.

[sleepy3]

"Also it's ironic you speak of airport security. The main reason why they stepped it up was BECAUSE of the act that happened. "

My point exactly. You know what can happen, therefore you STEP UP YOUR SECURITY so it DOES NOT happen.

[RAVEN81]

Don't blame Sony, blame hackers

[Shazz]

the media are making this worse with all these articles abot how bad it is ffs

[denero1]

i was waiting to see how fanboys on n4g would try and twist it sad -_-

by saying they didn't know for seven whole days would make them look incompetent -_-

[gamingisnotacrime]

so the media failed on the whole PS3 is doomed fiasco, so this is like a second chance at taking down the PS3

pathetic

[Lindsey]

I think the mainstream media failed a lot of people in this. I was just looking through Google news and saw the first article I had seen on this from FoxNews.com

I thought O'Reily was looking out for me?!

[Infernostew]

Good thing I took my CC off PSN right when this whole custom firmware BS started. I knew that there was a possibility that something like this could happen.

[blahblah]

no one can guarantee that info didn't just became invisible instead of deleted and still resided in databases for their internal purposes.

[Infernostew]

True. I'll probably call up my credit card company tomorrow and see if there's been any increased activity. They usually call me if there's any suspicious purchases.

[reaver]

Did enyone even consider that maybe Sony didn't know what was going on yet until recently.
They had to hire an outside firm to find out what went wrong.
So maybe the reason that Sony did not give any information sooner, is because they had to wait for the firm to discover what went wrong.

[Christopher]

Ignorance has run rampant.

1. No company will release information on security issues until they are proven and the full details are understood and are in the process of being corrected.

2. Said companies have already worked with the CC companies and any government agencies that would be involved in such illegal intrusions from the outset. This is standard protocol.

3. If Sony had released said information prior to any validation of what had occurred, the only result from that would have been the FUD that we are experiencing now. Only problem is, it wouldn't have been validated and completely understood at that time and could have changed over time, making Sony look like they are trying to change their story.

4. No matter how Sony handles this situation, it is a no-win one for them. If you had known since last Wednesday or when it was announced, they would have received the same level of negative feedback from the community.

5. If you honestly believe that Sony doesn't understand the importance of securing and maintaining customer information against fraudulent uses, you are grossly misinformed.

[thekiddfran]

Excellently said.

[UnNaTuRaL1]

#1 The day psn was shut down warning of possible leaked user information should have been made public.
So people could take the proper action to protect themselves.

#3 Well the FUD so to speak was going to happen regardless why not atleast warn your psn users. This only made them look worse by not doing so. I for one would like to know as soon as possible.

#4 Yeah psn was hacked they were gonna get negative feedback regardless. Now though its gonna be alot worse by letting time pass with hackers holding our information to do with as they please before we even knew about it. In a week a ton of damage can be done with stolen info.

[rockleex]

Thankfully cgoodno was one of the two that recently became N4G mods. :D

[n4gisatroll]

So is Netflix users affected? I signed up for Netflix the night it went down. I don't know if I should worry or if Netflix uses a different system that can't be accessed through Sonys servers.

[Christopher]

You're not affected. Netflix is managed on their own systems and the only element between them and Sony is identifying a device that is allowed to play Netflix content tied to your netflix login credentials, which are verified on Netflix servers.

[n4gisatroll]

Thanks for the reply! I'm so relieved. Bubble up for you!

[frelyler]

Stupid article looking for hits. Major BANKING COMPANIES have had similar problems before. People like to think no matter what their info is safe. It is not safe anywhere. If someone wants the info they are going to get it. If you want to direct anger direct it at the people stealing it.

[kreate]

is this really true though?
Sony really lost our credit card/personal info to outside sources?

i think there was a earlier artile something about it but i cant find it now cuz i was at work.

cuz if sony really is at fault and got our personal info revealed to outside sources, im kinda pissed at Sony's incompetence.

[UnNaTuRaL1]

I swear this website is full of teenage kids with a hard on for anything sony. It doesn't matter what sony does you all will follow them like blind brain washed robots. I own a psx/psp/ps2/ps3 but i am severely shaken in my stance on how i view Sony as a company after all that has taken place. Wake up people and quit with the fanboy crap this thing is much bigger than that.

[jukins]

did you put your real info and credit card on the ps3? if you didnt your stance shouldnt change if you did then you have no reason to be mad. in now way did sony GIVE OUT your info this was a "personal" attack against sony. if it werent sony it wouldve been someone else. like you said its much bigger than that. it just happens to have happened to sony. point is if you have your info on any website, credit card info saved like on amazon or such you should know theres always a potential risk.

it sucks this happened but how can you blame sony? when a hacker/hackers are skilled and determined theres not much that can stand up to them. like i said before it sucks but if it wasnt sony it can and will always be someone else.

[Inception]

Holy s***, now Gamepro too?
lol it's like 2006 / 2007 when all media combining their forces to attack PS3 and bring down Sony to the lowest level of DOOM!

i bet this years they save those energy again and waited for the right time to unleash it XD

[vikingland1]

Blind fanboys sony are the greatest they have never done anything wrong EVER.BBBBBut XBL went down for 10 days (but not mine)Xbox sucks sony is the best.Jeebus it's it makes me sick.

[RSEagle]

If this happened to Microsoft I assure you half the people on this site would be up in arms against them. But Sony? No, it's not their fault!

[RAVEN81]

the only reason i dont like 360n is cuz then jump the gun with the 360 and released it knowing that there was a big flaw aka rrod

[RAVEN81]

sleepy3
I hope you don't think the same of airport security. I would much rat5her they are proactive and think of ways the system can be exploited than just sit and wait for planes to be bombed THEN fix the security holes.

oh but that's what bush did do

[Jihaad_cpt]

why not just cancel your credit card and get a new one if you are that worried? Why are people holding on to their credit card like they have no choice?