Print 54 comment(s) - last by Moishe.. on May 2 at 4:31 PM

2.2 million users' cards are reportedly in the database

Millions of customers were shocked to hear Sony Computer Entertainment America LLC (U.S.) and Sony Computer Entertainment Europe (EU) had lost their personal information -- name, username, password, address, birth date, and password recovery question -- and, more importantly, that it potentially lost their credit and debit cards as well.

Sony wrote:

While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility.

It essentially then went on to tell people that they were on their own and that it was customers' own responsibility to protect themselves from credit fraud.

Now it appears the worse case scenario is indeed playing out -- according to recent forum posts, a database with "a large section of the PSN database containing complete personal details along (with credit card numbers)...are being offer (sic) up for sale."

Security researcher Kevin Stevens has witnessed malicious hackers discussing the supposed database.  He posted to Twitter, "Supposedly the hackers selling the DB says it has: fname, lnam, address, zip, country, phone, email, password, dob, ccnum, CVV2, exp date," adding, "it is not a rumor, it was a conversation on a criminal forum."

If someone gains access to this database, it would be easy to issue hundreds of millions of fraudulent charges.  Such charges can put a black mark on your credit score.

Famed hardware jailbreaker George "GeoHot" Hotz chimed in on the reports, writing, "I sure am glad I don’t have a PSN account about now."

In his blog he adds:

And to anyone who thinks I was involved in any way with this, I'm not crazy, and would prefer to not have the FBI knocking on my door. Running homebrew and exploring security on your devices is cool, hacking into someone elses server and stealing databases of user info is not cool. You make the hacking community look bad, even if it is aimed at douches like Sony.


...the fault lies with the (Sony) executives who declared a war on hackers, laughed at the idea of people penetrating the fortress that once was Sony, whined incessantly about piracy, and kept hiring more lawyers when they really needed to hire good security experts. Alienating the hacker community is not a good idea.

GeoHot, a self-admitted one-time victim of identity theft, isn't a huge fan of Sony.  He recently settled with the electronics giant in a lawsuit over his jailbreak of the PS3.  Reportedly, GeoHot essentially scored a big win with the settlement, though precise details haven't been revealed.

The attacks came soon after the settlement.  While few suspected GeoHot, some do suspect that members of the loosely organized hacker group Anonymous -- a group which supported GeoHot during the Sony legal battle (without his endorsement) -- might have been involved.

Regardless, this is bad news for Sony and worse news for its customers.  If you have a credit or debit card that you know is filed with service, you might want to talk to your bank about changing your number as soon as possible.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

Sony should buy the database
By BugblatterIII on 4/29/2011 9:12:02 AM , Rating: 2

I'm debating whether to cancel my card. This may just be yet another scare that turns into nothing, but this is the first of those scares that's included MY credit card.

Given the number of legitimate transactions my card provider has blocked I'd hope that they'd catch anything nefarious, and as I understand it they're liable for any losses as long as I've taken reasonable precautions.

Hearsay on a news site is a long way from official notification, so I don't believe I can be blamed for not changing my details at this stage.

However if Sony confirms that the CC detais have been stolen then I think I'll go ahead and cancel the card, even though it's going to cause me lots of hassle.

I think when PSN is back up I'll be cancelling that too. What the hell all this information was doing in the same place I'd love to know. I'm development manager for an online travel insurance company. We take payments online but credit card information never even touches our systems. However we're still able to re-bill the credit cards. It's not that difficult; there's really no need to store the details on your own systems. They probably thought they were impregnable; arrogance pure and simple.

RE: Sony should buy the database
By crazyblackman on 4/29/2011 3:34:39 PM , Rating: 1
This is the DailyTech equivalent of a Fox New's "BREAKING NEWS" cut in.

Cue the condescending, arrogant narrator's voiceover leading in..."WE DISTORT, YOU DECIDE."

RE: Sony should buy the database
By Bonesdad on 4/30/2011 3:41:56 PM , Rating: 2

By Reclaimer77 on 4/29/2011 6:19:20 PM , Rating: 2
I think when PSN is back up...

You mean IF, right? In Internet years PSN has been down for 20.

"If you can find a PS3 anywhere in North America that's been on shelves for more than five minutes, I'll give you 1,200 bucks for it." -- SCEA President Jack Tretton

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki