Sony Faces Dual Data Breaches: Lessons Learned and Ongoing Investigations

In a data breach notification submitted to the Office of the Main Attorney General, Sony disclosed that 6,791 individuals, all either current or former employees of Sony Interactive Entertainment in the US, had their personal data compromised. Sony has initiated communication with these affected individuals, providing detailed explanations of the incident and the specific nature of the personal and sensitive data exposed.

In response to this breach, Sony is offering each impacted person 24 months of Equifax ID WatchDog or Complete Premier credit monitoring and identity restoration services.

The second breach, previously reported last month, involved a new ransomware group named Ransomed.vc, which claimed to have stolen “all” of Sony’s data. However, the sample provided by the group lacked credibility. Sony has since confirmed the occurrence of this second breach and has taken immediate steps.

A Sony spokesperson clarified that the incident was isolated to a single server located in Japan, employed for internal testing within the Entertainment, Technology, and Services (ET&S) business sector. This server has been taken offline while investigations continue. Fortunately, there is currently no evidence that customer or business partner data was stored on the affected server, and no other Sony systems have been compromised. Sony asserts that its operations remain unaffected.

Unlike the significant PlayStation Network breach of 2011, this recent compromise appears to be relatively contained and not directly attributable to Sony’s negligence. Nonetheless, it underscores the importance of strengthening security measures, prompting Sony to reevaluate its reliance on secure file transfer services and explore additional safeguards for its employees. Regarding the second breach, further details regarding its cause and impact from Sony are awaited.