2011 PlayStation Network outage

Cyberattack surrounding PlayStation Network December 2024 PlayStation Network logo (2015).png PlayStation Network logo 2011 04 20 2011 05 14 24 days (3 weeks and 3 days) "External intrusion", data breach PlayStation Network and Qriocity services *Services restored after 23 days of downtime, with compensation offered to PSN users Personal data exposed for 77.1 million PlayStation Network accounts $171 million in costs for Sony The 2011 PlayStation Network outage (sometimes referred to as the 2011 PSN Hack) was the result of an "external intrusion" on Sony's PlayStation Network and Qriocity services, in which personal details from approximately 77 million accounts were compromised and prevented users of PlayStation 3 and PlayStation Portable consoles from accessing the service.PlayStation Network Restoration Begins PlayStation Network / PSN News Sony United Kingdom 2011-05-17 http://uk.playstation.com/psn/news/articles/detail/item369506/PSN-Qriocity-Service-Update/ 2011-10-20 2016-03-03 https://web.archive.org/web/20160303222252/http://uk.playstation.com/psn/news/articles/detail/item369506/PSN-Qriocity-Service-Update/ dead https://www.bbc.co.uk/news/technology-13192359 Sony faces legal action over attack on PlayStation network BBC News bbc.co.uk 2011-04-28 2011-04-29 2023-09-24 https://web.archive.org/web/20230924124659/https://www.bbc.co.uk/news/technology-13192359 live Richmond Shane Millions of internet users hit by massive Sony PlayStation data theft Telegraph London 2011-04-26 https://www.telegraph.co.uk/technology/news/8475728/Millions-of-internet-users-hit-by-massive-Sony-PlayStation-data-theft.html https://web.archive.org/web/20110428161228/http://www.telegraph.co.uk/technology/news/8475728/Millions-of-internet-users-hit-by-massive-Sony-PlayStation-data-theft.html dead April 28, 2011 2011-04-29Griffith Chris PlayStation users in Australia urged to check credit card activity Australian IT The Australian 2011-04-27 https://www.theaustralian.com.au/life/gadgets/playstation-users-in-australia-urged-to-check-credit-card-activity/news-story/60dd8ccee4e52d1ba1f9139bffc4b8bc 2011-11-20 2023-03-21 subscription https://web.archive.org/web/20230321011211/http://www.theaustralian.com.au/australian-it/exec-tech/playstation-users-in-australia-urged-to-check-credit-card-activity/story-e6frgazf-1226045582897 live The attack occurred between April 17 and April 19, 2011, forcing Sony to deactivate the PlayStation Network servers on April 20. The outage lasted 24 days.Owen Good http://kotaku.com/5804318/ Welcome Back PSN: The Winners Kotaku.com 2011-05-20 2011-06-02 2011-11-10 https://web.archive.org/web/20111110232907/http://kotaku.com/5804318 dead Government officials in various countries voiced concern over the theft and Sony's one-week delay before warning its users. The breach resulted in the exposure and vulnerability of personally identifiable information, including usernames, physical addresses, email addresses, dates of birth, passwords, and financial details such as credit card and debit card information.Kolevski David Michael Katina Abbas Roba Freeman Mark Cloud computing data breaches: A review of U.S. Regulation and data breach notification literature 2021-10-28 1–7 2021 IEEE International Symposium on Technology and Society (ISTAS) http://dx.doi.org/10.1109/istas52410.2021.9629173 IEEE 10.1109/istas52410.2021.9629173 978-1-6654-3580-2 2024-03-15 2024-05-22 https://web.archive.org/web/20240522150130/https://ieeexplore.ieee.org/document/9629173/ live Background Sony had faced some firmware and hacking-related controversies leading up to the outage. In March 2010, Sony launched a firmware update for the PlayStation 3 which removed the ability to install third-party operating systems like Linux.2010-03-28 PS3 Firmware (v3.21) Update https://blog.playstation.com/2010/03/28/ps3-firmware-v3-21-update/ 2022-09-13 PlayStation.Blog en-US 2019-04-26 https://web.archive.org/web/20190426203735/https://blog.us.playstation.com/2010/03/28/ps3-firmware-v3-21-update/ live PSN Hack Attack Summary 6 May 2011 https://www.youtube.com/watch?v=QVU6v53ow8k en 2022-09-13 IGN 2022-09-13 https://web.archive.org/web/20220913134634/https://www.youtube.com/watch?v=QVU6v53ow8k live This move sparked significant backlash from the modding community. George Hotz, also known as Geohot, managed to jailbreak the PS3 firmware on January 2, 2011, and began sharing the jailbreak online shortly afterward.Geohot releases PS3 jailbreak for firmware 3.55, world ceases to have any meaning https://www.engadget.com/2011-01-08-geohot-releases-ps3-jailbreak-for-firmware-3-55-world-ceases-to.html 2022-09-13 Engadget 9 January 2011 en-US 2023-10-01 https://web.archive.org/web/20231001083134/https://www.engadget.com/2011-01-08-geohot-releases-ps3-jailbreak-for-firmware-3-55-world-ceases-to.html live In response, Sony sued Hotz on January 11, 2011, for his jailbreaking activities.Sony follows up, officially sues Geohot and fail0verflow over PS3 jailbreak https://www.engadget.com/2011-01-12-sony-follows-up-officially-sues-geohot-and-fail0verflow-over-ps.html 2022-09-13 Engadget 12 January 2011 en-US 2017-10-19 https://web.archive.org/web/20171019152043/https://www.engadget.com/2011/01/12/sony-follows-up-officially-sues-geohot-and-fail0verflow-over-ps/ live The hacker group Anonymous initiated "Operation Sony" on April 2, 2011, as a form of protest. Sony eventually settled the lawsuit with Hotz by April 11.Sony and hacker GeoHot call a truce in bitter legal battle http://www.nbcnews.com/tech/tech-news/sony-hacker-geohot-call-truce-bitter-legal-battle-flna124038 2022-09-13 NBC News 11 April 2011 en 2023-10-01 https://web.archive.org/web/20231001083222/https://www.nbcnews.com/tech/tech-news/sony-hacker-geohot-call-truce-bitter-legal-battle-flna124038 live Following this, Anonymous called for a public protest against Sony on April 13. Extent of the breach Personal details from approximately 77 million accounts were compromised and prevented users of PlayStation 3 and PlayStation Portable consoles from accessing the service. Credit card data was encrypted, but Sony admitted that other user information was not encrypted at the time of the intrusion.http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/ Q&A #1 for PlayStation Network and Qriocity Services – PlayStation Blog Blog.us.playstation.com 2010-12-20 2011-04-29 2011-05-14 https://web.archive.org/web/20110514224707/http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/ live Stuart Keith https://www.theguardian.com/technology/gamesblog/2011/apr/27/playstation-network-hack-sony PlayStation Network hack: why it took Sony seven days to tell the world | Technology | guardian.co.uk Guardian 2011-04-27 2011-04-29 London 2023-03-21 https://web.archive.org/web/20230321012120/https://www.theguardian.com/technology/gamesblog/2011/apr/27/playstation-network-hack-sony live The Daily Telegraph reported that "If the provider stores passwords unencrypted, then it's very easy for somebody else – not just an external attacker, but members of staff or contractors working on Sony's site – to get access and discover those passwords, potentially using them for nefarious means."Williams Christopher https://www.telegraph.co.uk/technology/sony/8478404/PlayStation-hack-Sony-users-urged-to-change-passwords.html PlayStation hack: Sony users urged to change passwords Telegraph 2011-04-28 2011-04-29 London 2023-03-21 https://web.archive.org/web/20230321012410/https://www.telegraph.co.uk/technology/sony/8478404/PlayStation-hack-Sony-users-urged-to-change-passwords.html live On May 2, Sony clarified the "unencrypted" status of users' passwords, stating that:http://blog.us.playstation.com/2011/05/02/playstation-network-security-update// PlayStation Network Security Update – PlayStation Blog Blog.us.playstation.com 2011-05-02 2011-05-07 2011-05-05 https://web.archive.org/web/20110505070454/http://blog.us.playstation.com/2011/05/02/playstation-network-security-update/ live While the passwords that were stored were not “encrypted,” they were transformed using a cryptographic hash function. There is a difference between these two types of security measures which is why we said the passwords had not been encrypted. But I want to be very clear that the passwords were not stored in our database in cleartext form. Nearly a week after the outage, Sony confirmed that it "cannot rule out the possibility"https://www.bbc.co.uk/news/technology-13206004 BBC News - Sony's PlayStation hack apology Bbc.co.uk 2011-04-19 2011-04-29 2023-03-21 https://web.archive.org/web/20230321012437/https://www.bbc.co.uk/news/technology-13206004 live that personally identifiable information such as PlayStation Network account username, password, home address, and email address had been compromised. Sony also mentioned the possibility that credit card data was taken—after claiming that encryption had been placed on the databases, which would partially satisfy PCI Compliance for storing credit card information on a server. Subsequent to the announcement on both the official blog and by e-mail, users were asked to safeguard credit card transactions by checking bank statements. This warning came nearly a week after the initial "external intrusion" and while the Network was turned off.Reynolds Isabel https://www.reuters.com/article/uk-sony-stolendata-idUKTRE73Q0F720110427 Furore at Sony after Playstation user data stolen Reuters 2009-02-09 2011-04-29 2023-03-21 https://web.archive.org/web/20230321011210/https://www.reuters.com/article/uk-sony-stolendata-idUKTRE73Q0F720110427 live At the time of the outage, with a count of 77 million registered PlayStation Network accounts,http://blog.eu.playstation.com/2011/04/28/playstation-network-and-qriocity-outage-faq/ PlayStation Network and Qriocity Outage FAQ – PlayStation.Blog.Europe 28 April 2011 Blog.eu.playstation.com 2011-04-29 2011-05-04 https://web.archive.org/web/20110504174033/http://blog.eu.playstation.com/2011/04/28/playstation-network-and-qriocity-outage-faq/ live it was not only one of the largest data security breaches, but also the longest PS Network outage in history.https://www.cbc.ca/news/science/playstation-data-breach-deemed-in-top-5-ever-1.1059548 PlayStation data breach deemed in 'top 5 ever' - Business - CBC News Cbc.ca 2011-04-27 2011-04-29 2012-11-09 https://web.archive.org/web/20121109051959/http://www.cbc.ca/news/business/story/2011/04/27/technology-playstation-data-breach.html live http://news.sky.com/home/technology/article/15979992 Video: Sony PlayStation - Hacker Breaks Into Network And Steals Details Of Millions Of Gamers | Technology | Sky News News.sky.com 2011-04-29 2023-03-21 https://web.archive.org/web/20230321012125/https://news.sky.com/home/technology/article/15979992 live It surpassed the 2007 TJX hack which affected 45 million customers.https://www.telegraph.co.uk/technology/sony/8476757/PlayStation-hack-top-five-data-thefts.html PlayStation hack: top five data thefts Telegraph 2011-04-27 2011-04-29 London 2023-03-21 https://web.archive.org/web/20230321011204/https://www.telegraph.co.uk/technology/sony/8476757/PlayStation-hack-top-five-data-thefts.html live In 2012, The Guardian wrote: The attack, which may have leaked credit card details for millions of users, has never been traced to any group – although Sony suggested not long afterwards that Anonymous might have been involved. Since then it has given no further details about who it suspects of carrying out the attack, and no data from the attack has ever been posted publicly.Arthur Charles 2012-08-29 LulzSec hacker arrested over Sony attack https://www.theguardian.com/technology/2012/aug/29/lulzsec-hacker-arrest-sony-attack 2024-04-29 The Guardian en-GB 0261-3077 2024-05-22 https://web.archive.org/web/20240522150101/https://www.theguardian.com/technology/2012/aug/29/lulzsec-hacker-arrest-sony-attack live Timeline of the outage April 20, 2011 Sony acknowledged on the official PlayStation Blog that it was "aware certain functions of the PlayStation Network" were down. Upon attempting to sign in via the PlayStation 3, users received a message indicating that the network was "undergoing maintenance".Update on PSN Service Outages PlayStation Blog United States 2011-04-20 http://blog.us.playstation.com/2011/04/20/update-on-psn-service-outages-2/ 2011-04-29 2016-03-10 https://web.archive.org/web/20160310105101/http://blog.us.playstation.com/2011/04/20/update-on-psn-service-outages-2/ live Timeline of Sony's PlayStation Network outage hken.ibtimes.com 2011-05-15 http://hken.ibtimes.com/articles/145875/20110515/timeline-of-sony-s-playstation-network-outage.htm 2011-05-15 https://web.archive.org/web/20110518134456/http://hken.ibtimes.com/articles/145875/20110515/timeline-of-sony-s-playstation-network-outage.htm 2011-05-18 dead The following day, Sony asked its customers for patience while the cause of outage was investigated and stated that it may take "a full day or two" to get the service fully functional again.Latest Update on PSN Outage PlayStation Blog United States 2011-04-21 http://blog.us.playstation.com/2011/04/21/latest-update-on-psn-outage/ 2011-04-29 2016-05-07 https://web.archive.org/web/20160507204659/http://blog.us.playstation.com/2011/04/21/latest-update-on-psn-outage/ live Sony suspended all PlayStation Network and Qriocity services worldwide.http://us.playstation.com/support/answer/index.htm?a_id=2356 PlayStation Knowledge Center | Support - PlayStation.com us.playstation.com 2011-01-10 2011-04-29 2012-10-31 https://web.archive.org/web/20121031055511/http://us.playstation.com/support/answer/index.htm?a_id=2356 live While most games remained playable in their offline modes, the PlayStation 3 was unable to play certain Capcom titles in any form. Streaming video providers throughout different regions such as Hulu, Vudu, Netflix and LoveFilm displayed the same maintenance message. Some users claimed to be able to use Netflix's streaming serviceBarrera Rey Netflix-still-works-on-your-ps3-despite-the-outage http://www.psnation.org/2011/04/25/netflix-still-works-on-your-ps3-despite-the-outage/ PSNation 25 April 2011 27 April 2011 https://web.archive.org/web/20110427112834/http://www.psnation.org/2011/04/25/netflix-still-works-on-your-ps3-despite-the-outage/ dead but others were unable.http://gigaom.com/video/playstation-network-outage-bad-news-for-netflix-hulu/ PlayStation Network Outage Bad News for Netflix and Hulu: Online Video News Gigaom.com 2011-04-29 dead https://web.archive.org/web/20110429231541/http://gigaom.com/video/playstation-network-outage-bad-news-for-netflix-hulu/ 2011-04-29 April 22, 2011 Sony announced an "external intrusion" had affected the PlayStation Network and Qriocity services.Update On PlayStation Network/Qriocity Services PlayStation Blog United States 2011-04-22 http://blog.us.playstation.com/2011/04/22/update-on-playstation-network-qriocity-services/ 2011-04-29 2016-04-27 https://web.archive.org/web/20160427142508/http://blog.us.playstation.com/2011/04/22/update-on-playstation-network-qriocity-services/ live Sony expressed their regrets for the downtime and called the task of repairing the system "time-consuming" but would lead to a stronger network infrastructure and additional security.http://blog.us.playstation.com/2011/04/23/latest-update-for-psnqriocity-services/ Latest Update for PSN/Qriocity Services – PlayStation Blog Blog.us.playstation.com 2011-04-23 2011-04-29 2017-05-22 https://web.archive.org/web/20170522042442/https://blog.us.playstation.com/2011/04/23/latest-update-for-psnqriocity-services/ live April 25, 2011 Sony spokesman Patrick Seybold reiterated on the PlayStation Blog that fixing and enhancing the network was a "time intensive" process with no estimated time of completion.http://blog.us.playstation.com/2011/04/25/psn-update/ PSN Update – PlayStation Blog Blog.us.playstation.com 2011-04-25 2011-04-29 2017-06-13 https://web.archive.org/web/20170613171153/https://blog.us.playstation.com/2011/04/25/psn-update/ live However, the next day Sony stated that there was a "clear path to have PlayStation Network and Qriocity systems back online", with some services expected to be restored within a week. Furthermore, Sony acknowledged the "compromise of personal information as a result of an illegal intrusion on our systems."http://blog.us.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/ Update on PlayStation Network and Qriocity – PlayStation Blog Blog.us.playstation.com 2011-04-19 2011-04-29 2011-04-26 https://web.archive.org/web/20110426221500/http://blog.us.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/ live April 26, 2011 On April 26, 2011, Sony on the PlayStation Blog why it took so long to inform PSN users of the data theft:http://blog.us.playstation.com/2011/04/26/clarifying-a-few-psn-points/ Clarifying a Few PSN Points – PlayStation Blog Blog.us.playstation.com 2011-04-26 2011-05-07 2011-05-07 https://web.archive.org/web/20110507210829/http://blog.us.playstation.com/2011/04/26/clarifying-a-few-psn-points/ live There’s a difference in timing between when we identified there was an intrusion and when we learned of consumers’ data being compromised. We learned there was an intrusion April 19th and subsequently shut the services down. We then brought in outside experts to help us learn how the intrusion occurred and to conduct an investigation to determine the nature and scope of the incident. It was necessary to conduct several days of forensic analysis, and it took our experts until yesterday to understand the scope of the breach. We then shared that information with our consumers and announced it publicly this afternoon. April 27, 2011 Sony to provide an update in regards to a criminal investigation in a blog posted on April 27: "We are currently working with law enforcement on this matter as well as a recognized technology security firm to conduct a complete investigation. This malicious attack against our system and against our customers is a criminal act and we are proceeding aggressively to find those responsible." May 1, 2011 Sony announced a "Welcome Back" program for customers affected by the outage. The company also confirmed that some PSN and Qriocity services would be available during the first week of May.http://blog.eu.playstation.com/2011/05/01/some-playstation-network-and-qriocity-services-to-be-available-this-week/ Some PlayStation Network And Qriocity Services To Be Available This Week – PlayStation.Blog.Europe May 2011 Blog.eu.playstation.com 2011-05-01 2016-03-06 https://web.archive.org/web/20160306154103/https://blog.eu.playstation.com/2011/05/01/some-playstation-network-and-qriocity-services-to-be-available-this-week/ live May 2, 2011 Sony issued a press release, according to which the Sony Online Entertainment (SOE) services had been taken offline for maintenance due to potentially related activities during the initial criminal hack. Over 12,000 credit card numbers, albeit in encrypted form, from non-U.S. cardholders and additional information from 24.7 million SOE accounts may have been accessed.http://www.soe.com/securityupdate/pressrelease.vm Service Under Maintenance SOE 2010-03-31 2011-05-04 dead https://archive.today/20130202171207/http://www.soe.com/securityupdate/pressrelease.vm 2013-02-02 https://www.gameinformer.com/b/news/archive/2011/05/02/thousands-of-credit-cards-stolen-during-second-sony-hack.aspx Sony Confirms Thousands Of Credit Cards Stolen During Hack - GameInformer News Game Informer 2011-05-02 2011-05-02 2016-02-02 https://web.archive.org/web/20160202020044/http://www.gameinformer.com/b/news/archive/2011/05/02/thousands-of-credit-cards-stolen-during-second-sony-hack.aspx live During the week, Sony sent a letter to the US House of Representatives, answering questions and concerns about the event.http://blog.us.playstation.com/2011/05/04/sonys-response-to-the-u-s-house-of-representatives/ Sony's Response to the U.S. House of Representatives – PlayStation Blog Blog.us.playstation.com 2010-12-20 2011-05-07 2011-05-06 https://web.archive.org/web/20110506151321/http://blog.us.playstation.com/2011/05/04/sonys-response-to-the-u-s-house-of-representatives/ live In the letter Sony announced that they would be providing Identity Theft insurance policies in the amount of US$1 million per user of the PlayStation Network and Qriocity services, despite no reports of credit card fraud being indicated. This was later confirmed on the PlayStation Blog, where it was announced that the service, AllClear ID Plus powered by Debix, would be available to users in the United States free for 12 months, and would include Internet surveillance, complete identity repair in the event of theft and a $1 million identity theft insurance policy for each user.http://blog.us.playstation.com/2011/05/05/sony-offering-free-allclear-id-plus-identity-theft-protection-in-the-united-states-through-debix-inc/ Sony Offering Free 'AllClear ID Plus' Identity Theft Protection in the United States through Debix, Inc. – PlayStation Blog 5 May 2011 Blog.us.playstation.com 2011-05-07 2011-07-11 https://web.archive.org/web/20110711121501/http://blog.us.playstation.com/2011/05/05/sony-offering-free-allclear-id-plus-identity-theft-protection-in-the-united-states-through-debix-inc/ live http://blog.us.playstation.com/2011/05/05/a-letter-from-howard-stringer/ A Letter from Howard Stringer – PlayStation Blog Blog.us.playstation.com 2010-12-20 2011-05-07 2011-05-06 https://web.archive.org/web/20110506215756/http://blog.us.playstation.com/2011/05/05/a-letter-from-howard-stringer/ live May 3, 2011 Sony Computer Entertainment CEO Kazuo Hirai reiterated said the "external intrusion" which had caused them to shut down the PlayStation Network constituted a "criminal cyber attack".Sony: PlayStation Network Resumes This Week Watt Peggy http://www.pcworld.com/article/226795/sony_playstation_network_resumes_this_week.html pcworld.com 30 April 2011 2 May 2011 3 August 2023 https://web.archive.org/web/20230803171239/https://www.pcworld.com/article/226795/sony_playstation_network_resumes_this_week.html live Hirai expanded further, claiming that Sony systems had been under attack prior to the outage "for the past month and half", suggesting a concerted attempt to target Sony.PSN 'welcome back program' includes a free download, 30 days free PlayStation Plus, Qriocity Fletcher JC http://www.joystiq.com/2011/05/01/psn-outage-plus-qriocity-free/ joystiq.com 2011-05-01 2011-05-02 https://web.archive.org/web/20120715184052/http://www.joystiq.com/2011/05/01/psn-outage-plus-qriocity-free/ 2012-07-15 dead On May 3 Sony stated in a press release that there may be a correlation between the attack that had occurred on April 16 towards the PlayStation Network and one that compromised Sony Online Entertainment on May 2. This portion of the attack resulted in the theft of information on 24.6 million Sony Online Entertainment account holders. The database contained 12,700 credit card numbers, particularly those of non-U.S. residents, and had not been in use since 2007 as much of the data applied to expired cards and deleted accounts. Sony updated this information the following day by stating that only 900 cards on the database were still valid.24.6 million SOE accounts potentially compromised News gamesindustry.biz 2011-03-21 http://www.gamesindustry.biz/articles/2011-05-03-24-6-million-soe-accounts-potentially-compromised 2011-05-04 2011-05-06 https://web.archive.org/web/20110506125722/http://www.gamesindustry.biz/articles/2011-05-03-24-6-million-soe-accounts-potentially-compromised live The attack resulted in the suspension of SOE servers and Facebook games. SOE granted 30 days of free time, plus one day for each day the server was down, to users of Clone Wars Adventures, DC Universe Online, EverQuest, EverQuest II, EverQuest Online Adventures, Free Realms, Pirates of the Burning Sea, PlanetSide, Poxnora, Star Wars Galaxies and Vanguard: Saga of Heroes, as well as other forms of compensation for all other Sony Online games. May 4, 2011 Sony announced that it was adding Data Forte to the investigation team of Guidance Software and Protiviti in analysing the attacks. Legal aspects of the case were handled by Baker & McKenzie.http://www.vg247.com/2011/05/04/another-team-added-to-sonys-psn-investigation/ Another team added to Sony's PSN investigation 4 May 2011 VG247 2011-05-04 2012-09-26 https://web.archive.org/web/20120926182155/http://www.vg247.com/2011/05/04/another-team-added-to-sonys-psn-investigation/ live Sony stated their belief that Anonymous, a decentralized unorganized loosely affiliated group of hackers and activists may have performed the attack.Bartz Diane https://www.reuters.com/article/us-sony-idUSTRE73R0Q320110504 Sony blames Anonymous for stage-setting theft Reuters 2011-04-26 2011-05-04 2023-03-21 https://web.archive.org/web/20230321011211/https://www.reuters.com/article/us-sony-idUSTRE73R0Q320110504 live No Anons claimed any involvement.https://venturebeat.com/2011/04/22/as-playstation-network-outage-continues-hackers-deny-involvement/ Hackers deny involvement in PlayStation Network outage 22 April 2011 June 9, 2011 21 March 2023 https://web.archive.org/web/20230321011201/https://venturebeat.com/2011/04/22/as-playstation-network-outage-continues-hackers-deny-involvement/ live May 6, 2011 Sony stated they had begun "final stages of internal testing" for the PlayStation Network, which had been rebuilt.http://blog.eu.playstation.com/2011/05/06/important-step-for-service-restoration/ Important Step for Service Restoration – PlayStation.Blog.Europe Blog.eu.playstation.com 2011-05-06 2011-05-07 2016-05-26 https://web.archive.org/web/20160526171550/https://blog.eu.playstation.com/2011/05/06/important-step-for-service-restoration/ live However, the following day Sony reported that they would not be able to bring services back online within the one-week timeframe given on May 1, because "the extent of the attack on Sony Online Entertainment servers" had not been known at the time.http://www.joystiq.com/2011/05/06/psn-reactivation-delayed-for-further-testing-not-coming-back/ PSN reactivation delayed for 'further testing,' likely not coming back this week JC Fletcher Joystiq 2011-05-06 2011-05-07 https://web.archive.org/web/20110508234950/http://www.joystiq.com/2011/05/06/psn-reactivation-delayed-for-further-testing-not-coming-back/ 2011-05-08 dead SOE confirmed on their Twitter account that their games would not be available until some time after the weekend.https://twitter.com/SonyOnline/status/66671981101199360 Twitter / @Sony Online Ent.: We wanted to let you know ... twitter.com 2011 16 May 2011 28 May 2022 https://web.archive.org/web/20220528100349/https://twitter.com/SonyOnline/status/66671981101199360 live Reuters began reporting the event as "the biggest Internet security break-in ever".Reynolds Isabel https://www.reuters.com/article/uk-sony-idUKLNE74505420110506?type=companyNews Sony CEO apologises for data theft; shares fall 2 pct Reuters 2011-05-06 2011-05-07 2023-03-21 https://web.archive.org/web/20230321011201/https://www.reuters.com/article/uk-sony-idUKLNE74505420110506?type=companyNews live A Sony spokesperson said:https://www.reuters.com/article/sony-idUSL3E7G701T20110507 Sony removes data posted by hackers, delays PlayStation restart Reuters 2011-05-06 2013-10-10 Isabel Reynolds 2023-03-21 https://web.archive.org/web/20230321011211/https://www.reuters.com/article/sony-idUSL3E7G701T20110507 live Sony had removed the personal details of 2,500 people stolen by hackers and posted on a website The data included names and some addresses, which were in a database created in 2001 No date had been fixed for the restart May 14, 2011 Various services began coming back online on a country-by-country basis, starting with North America. These services included: sign-in for PSN and Qriocity services (including password resetting), online game-play on PS3 and PSP, playback of rental video content, Music Unlimited service (PS3 and PC), access to third party services (such as Netflix, Hulu, Vudu and MLB.tv), friends list, chat functionality and PlayStation Home.http://www.sony.net/SonyInfo/News/Press/201105/11-0515E/index.html Sony Global - News Releases - RESTORATION OF PLAYSTATIONNETWORK AND QRIOCITY SERVICES BEGINS May 15, 2011 May 15, 2011 Sony March 3, 2016 https://web.archive.org/web/20160303234350/http://www.sony.net/SonyInfo/News/Press/201105/11-0515E/index.html live The actions came with a firmware update for the PS3, version 3.61.http://blog.us.playstation.com/2011/05/14/ps3-system-software-update/ PS3 System Software Update - PlayStation Blog May 14, 2011 May 15, 2011 PlayStation Blog June 4, 2016 https://web.archive.org/web/20160604144913/http://blog.us.playstation.com/2011/05/14/ps3-system-software-update/ live As of May 15 service in Japan and East Asia had not yet been approved.Mochizuki Takashi http://www.foxbusiness.com/industries/2011/05/15/japan-restart-sony-online-games-services-approved/ Japan Restart of Sony Online Games Services Not Yet Approved FoxBusiness.com 2010-04-07 2011-06-02 https://web.archive.org/web/20110603074055/http://www.foxbusiness.com/industries/2011/05/15/japan-restart-sony-online-games-services-approved/ 2011-06-03 dead May 18, 2011 Sony shut down the password reset page on their site following the discovery of another exploithttp://www.eurogamer.net/articles/2011-05-18-sonys-psn-password-page-hacked Sony's PSN password page exploit May 18, 2011 May 18, 2011 Eurogamer March 26, 2016 https://web.archive.org/web/20160326141432/http://www.eurogamer.net/articles/2011-05-18-sonys-psn-password-page-hacked live that allowed users to reset other users' passwords, using the other user's email address and date of birth.http://kotaku.com/5803050/ Report: Sony PlayStation Network Password Reset Page Exploited, Customer Accounts Potentially Compromised May 18, 2011 May 18, 2011 Kotaku October 17, 2012 https://web.archive.org/web/20121017080831/http://kotaku.com/5803050/ dead Sign-in using PSN details to various other Sony websites was also disabled, but console sign-ins were not affected. May 23, 2011 Sony stated that the outage costs were $171 million.PlayStation Hack to Cost Sony $171M; Quake Costs Far Higher PC Magazine May 23, 2011 https://www.pcmag.com/article2/0,2817,2385790,00.asp August 23, 2017 January 6, 2018 https://web.archive.org/web/20180106231914/https://www.pcmag.com/article2/0,2817,2385790,00.asp live Reaction Graham Cluley, senior technology consultant at Sophos, said the breach "certainly ranks as one of the biggest data losses ever to affect individuals".Richmond Shane https://www.telegraph.co.uk/technology/news/8475728/Millions-of-internet-users-hit-by-massive-Sony-PlayStation-data-theft.html https://web.archive.org/web/20110428161228/http://www.telegraph.co.uk/technology/news/8475728/Millions-of-internet-users-hit-by-massive-Sony-PlayStation-data-theft.html dead April 28, 2011 Millions of internet users hit by massive Sony PlayStation data theft Telegraph April 26, 2011 April 29, 2011 London Security experts Eugene Lapidous of AnchorFree, Chester Wisniewski of Sophos Canada and Avner Levin of Ryerson University (now Toronto Metropolitan University) criticized Sony, questioning its methods of securing user data. Lapidous called the breach "difficult to excuse" and Wisniewski called it "an act of hubris or simply gross incompetence".Brightman James Sony Breach 'Difficult to Excuse' Say Security Experts IndustryGamers 2011-05-03 http://www.industrygamers.com/news/sony-breach-difficult-to-excuse-say-security-experts/ 2011-05-05 https://web.archive.org/web/20110505223935/http://www.industrygamers.com/news/sony-breach-difficult-to-excuse-say-security-experts/ 2011-05-05 dead Chung Emily Sony data breach update reveals 'bad practices' CBC News 2011-05-03 https://www.cbc.ca/news/science/sony-data-breach-update-reveals-bad-practices-1.986647 2011-05-05 2012-08-01 https://web.archive.org/web/20120801214421/http://www.cbc.ca/news/business/story/2011/05/03/sony-data-breach-playstation.html live Westervelt Robert Sony attack: Sony expands scope of its massive data security breach SearchSecurity.com 2011-05-03 http://searchsecurity.techtarget.com/news/2240035422/Sony-attack-Sony-expands-scope-of-its-massive-data-security-breach 2011-05-05 2011-05-05 https://web.archive.org/web/20110505232800/http://searchsecurity.techtarget.com/news/2240035422/Sony-attack-Sony-expands-scope-of-its-massive-data-security-breach live Schwartz Matthew J. Sony Reports 24.5 Million More Accounts Hacked InformationWeek 2011-05-03 http://www.informationweek.com/news/security/attacks/229402656 2011-05-05 2011-05-05 https://web.archive.org/web/20110505213521/http://www.informationweek.com/news/security/attacks/229402656 dead Government reactions US Senator Richard Blumenthal of Connecticut demanded answers from Sony about the data breachhttp://blumenthal.senate.gov/press/release/index.cfm?id=82698973-255D-4B92-9E18-39E5937C9361 Blumenthal Demands Answers from Sony over Playstation Data Breach Richard Blumenthal-US senator for Connecticut: Home 2011-04-26 dead https://web.archive.org/web/20110505041135/http://blumenthal.senate.gov/press/release/index.cfm?id=82698973-255D-4B92-9E18-39E5937C9361 May 5, 2011 by emailing SCEA CEO Jack Tretton arguing about the delay in informing its customers and insisting that Sony do more for its customers than just offer free credit reporting services. Blumenthal later called for an investigation by the US Department of Justice to find the person or persons responsible and to determine if Sony was liable for the way that it handled the situation.http://blumenthal.senate.gov/press/release/index.cfm?id=7BEBFD12-FFDD-40C2-BA5F-C50C7C9D9E09 Blumenthal Calls for DOJ Investigation of Sony Playstation Data Breach 28 April 2011 Richard Blumenthal-US senator for Connecticut: Home 2011-04-29 2011-05-05 https://web.archive.org/web/20110505035325/http://blumenthal.senate.gov/press/release/index.cfm?id=7BEBFD12-FFDD-40C2-BA5F-C50C7C9D9E09 live Congresswoman Mary Bono Mack and Congressman G. K. Butterfield sent a letter to Sony, demanding information on when the breach was discovered and how the crisis would be handled.http://www.abc2news.com/dpp/news/national/us-lawmakers-press-sony-for-info-on-data-breach US lawmakers press Sony for info on data breach Associated Press 2011-04-29 2011-04-30 https://web.archive.org/web/20110930032036/http://www.abc2news.com/dpp/news/national/us-lawmakers-press-sony-for-info-on-data-breach 2011-09-30 dead Privacy Commissioner of Canada Jennifer Stoddart confirmed that the Canadian authorities would investigate. The Commissioner's office conveyed their concern as to why the authorities in Canada weren't informed of a security breach earlier.http://www.canada.com/life/Privacy+Commissioner+office+investigate+Sony+PlayStation+hack/4684627/story.html#ixzz1KlAZpsAq Privacy Commissioner's office looking into Sony PlayStation hack Canada.com 2011-04-29 September 2018 InternetArchiveBot yes Following a formal investigation of Sony for breaches of the UK's Data Protection Act 1998, the Information Commissioner's Office fined Sony £250,000 ($395k) and issued a statement highly critical of the security Sony had in place: If you are responsible for so many payment card details and log-in details then keeping that personal data secure has to be your priority. In this case that just didn't happen, and when the database was targeted – albeit in a determined criminal attack – the security measures in place were simply not good enough. There's no disguising that this is a business that should have known better. It is a company that trades on its technical expertise, and there's no doubt in my mind that they had access to both the technical knowledge and the resources to keep this information safe. https://www.theregister.co.uk/2013/01/24/sony_psn_breach_fine/ Crap security lands Sony £250k fine for PlayStation Network hack The Register 2017-08-23 2018-01-07 https://web.archive.org/web/20180107061303/https://www.theregister.co.uk/2013/01/24/sony_psn_breach_fine/ live Legal action against Sony A lawsuit was posted on April 27 by Kristopher Johns from Birmingham, Alabama on behalf of all PlayStation users alleging Sony "failed to encrypt data and establish adequate firewalls to handle a server intrusion contingency, failed to provide prompt and adequate warnings of security breaches, and unreasonably delayed in bringing the PSN service back online."Ogg Erica http://news.cnet.com/8301-31021_3-20057921-260.html Sony sued for PlayStation Network data breach | Circuit Breaker - CNET News News.cnet.com 2011-03-24 2011-04-29 2011-05-04 https://web.archive.org/web/20110504223339/http://news.cnet.com/8301-31021_3-20057921-260.html dead http://dockets.justia.com/docket/california/candce/3:2011cv02063/240051/ Johns v. Sony Computer Entertainment America LLC et al Justia 2011-05-03 2011-05-03 2011-05-05 https://web.archive.org/web/20110505062501/http://dockets.justia.com/docket/california/candce/3:2011cv02063/240051/ live According to the complaint filed in the lawsuit, Sony failed to notify members of a possible security breach and storing members' credit card information,Schwartz Mathew J. http://www.informationweek.com/news/security/attacks/229402362 Sony Sued Over PlayStation Network Hack InformationWeek 2011-04-29 2011-04-29 https://web.archive.org/web/20110429231505/http://www.informationweek.com/news/security/attacks/229402362 dead a violation of PCI Compliance—the digital security standard for the Payment Card Industry. A Canadian lawsuit against Sony USA, Sony Canada and Sony Japan claimed damages up to C$1 billion including free credit monitoring and identity theft insurance.2011-05-04 Canadian Law Firm Files $1 Billion Lawsuit Against Sony Over PSN Data Breach http://www.gamasutra.com/view/news/34499/Canadian_Law_Firm_Files_1_Billion_Class_Action_Lawsuit_Against_Sony_Over_PSN_Data_Breach.php 2011-05-04 Gamasutra 2011-05-05 https://web.archive.org/web/20110505181455/http://www.gamasutra.com/view/news/34499/Canadian_Law_Firm_Files_1_Billion_Class_Action_Lawsuit_Against_Sony_Over_PSN_Data_Breach.php dead The plaintiff was quoted as saying, "If you can't trust a huge multi-national corporation like Sony to protect your private information, who can you trust? It appears to me that Sony focuses more on protecting its games than its PlayStation users".http://business.gather.com/viewArticle.action?articleId=281474979289837 Sony PlayStation Network Down: PSN Hit with $1.04B Class Action Suit Gather 2011-05-04 2011-05-04 https://web.archive.org/web/20110507064324/http://business.gather.com/viewArticle.action?articleId=281474979289837 2011-05-07 dead In October 2012 a California judge dismissed a lawsuit against Sony over the PSN security breach, ruling that Sony had not violated California's consumer-protection laws, citing "there is no such thing as perfect security".http://news.cnet.com/8301-1023_3-57538716-93/sony-psn-hacking-lawsuit-dismissed-by-judge/ Sony PSN hacking lawsuit dismissed by judge 2012-12-19 2013-01-30 https://web.archive.org/web/20130130200941/http://news.cnet.com/8301-1023_3-57538716-93/sony-psn-hacking-lawsuit-dismissed-by-judge/ live Compensation to users In a press conference in Tokyo on May 1, Sony announced a "Welcome Back" program. As well as "selected PlayStation entertainment content", the program promised to include 30 days free membership of PlayStation Plus for all PSN members, while existing PlayStation Plus members received an additional 30 days on their subscription. Qriocity subscribers received 30 days. Sony promised other content and services over the coming weeks.Yin-Poole Wesley http://www.eurogamer.net/articles/2011-05-01-psn-sony-outlines-welcome-back-gifts PSN: Sony outlines "Welcome Back" gifts PlayStation 3 Eurogamer United Kingdom 2011-05-01 2011-10-20 2011-05-05 https://web.archive.org/web/20110505060017/http://www.eurogamer.net/articles/2011-05-01-psn-sony-outlines-welcome-back-gifts live Hulu compensated PlayStation 3 users for the inability to use their service during the outage by offering one week of free service to Hulu Plus members.Jackson Leah Hulu Offering Free Credit For PS3 Subscribers TheFeed G4tv.com 2011-04-27 http://www.g4tv.com/thefeed/blog/post/712202/hulu-offering-free-credit-for-ps3-subscribers/ 2011-10-20 2012-10-17 https://web.archive.org/web/20121017092748/http://www.g4tv.com/thefeed/blog/post/712202/hulu-offering-free-credit-for-ps3-subscribers/ dead On May 16, 2011, Sony announced that two PlayStation 3 games and two PSP games would be offered for free from lists of five and four,JPPSPList † respectively.Details for PlayStation Network and Qriocity Customer Appreciation Program in North America PlayStation Blog May 16, 2011 http://blog.us.playstation.com/2011/05/16/details-for-playstation-network-and-qriocity-customer-appreciation-program-in-north-america/ May 17, 2011 May 1, 2016 https://web.archive.org/web/20160501180417/http://blog.us.playstation.com/2011/05/16/details-for-playstation-network-and-qriocity-customer-appreciation-program-in-north-america/ live Details Of The Welcome Back Programme For SCEE Users PlayStation Blog May 16, 2011 http://blog.eu.playstation.com/2011/05/16/details-of-the-welcome-back-programme-for-scee-users-2/ May 17, 2011 April 19, 2016 https://web.archive.org/web/20160419072951/https://blog.eu.playstation.com/2011/05/16/details-of-the-welcome-back-programme-for-scee-users-2/ live The games available varied by region and were only available in countries which had access to the PlayStation Store prior to the outage. On May 27, 2011, Sony announced the "welcome back" package for JapanPlayStationNetwork・Qriocity（キュリオシティ）の一部サービス  日本およびアジアの国・地域でも再開 ja SCEJ May 27, 2011 http://cdn.jp.playstation.com/msg/nr_20110527_psn_qriocity.html 20 October 2011 3 March 2016 https://web.archive.org/web/20160303233126/http://cdn.jp.playstation.com/msg/nr_20110527_psn_qriocity.html live and the Asia region (Hong Kong, Singapore, Malaysia, Thailand and Indonesia).Welcome Back Package for Hong Kong, Singapore, Malaysia, Thailand and Indonesia PlayStation.com May 27, 2011 http://asia.playstation.com/id/en/news/latestNewsDetail/227416 May 28, 2011 March 6, 2016 https://web.archive.org/web/20160306015136/https://asia.playstation.com/id/en/news/latestNewsDetail/227416 dead In the Asia region, a theme - Dokodemo Issyo Spring Theme - was offered for free in addition to the games available in the "welcome back" package. JPPSPList † 5 PSP games are offered in the Japanese market. + PS3 games available by region Game North America Europe (non-Germany) Germany Asia Japan Wipeout HD/Fury LittleBigPlanet InFamous Dead Nation Super Stardust HD Ratchet & Clank: Quest for Booty Hustle Kings The Last Guy Trash Panic LocoRoco Cocoreccho! Echochrome + PSP games available by region Game North America Europe (non-Germany) Germany Asia Japan LittleBigPlanet ModNation Racers Pursuit Force Killzone: LiberationKZ ‡ Everybody's Golf Portable 2 Buzz! Junior: Jungle Party Everybody's Stress Buster LocoRoco Midnight Carnival Patapon 2 What Did I Do to Deserve This, My Lord? KZ ‡ Version of Killzone Liberation offered does not offer online gameplay functionality. Credit card fraud There were reports on the Internet that some users experienced credit card fraud;http://www.pcworld.com/article/226775/playstation_network_users_reporting_credit_card_fraud.html PlayStation users reporting credit card fraud 30 April 2011 April 30, 2011 1 May 2011 https://web.archive.org/web/20110501212056/http://www.pcworld.com/article/226775/playstation_network_users_reporting_credit_card_fraud.html live http://www.abc.net.au/news/2011-04-28/hackers-run-up-debt-for-playstation-user/2695706 Hackers run up debt for PlayStation user ABC News 27 April 2011 April 30, 2011 2011-07-12 https://web.archive.org/web/20110712165433/http://www.abc.net.au/news/2011-04-28/hackers-run-up-debt-for-playstation-user/2695706 live https://www.theguardian.com/technology/blog/2011/apr/29/playstation-network-hackers-credit-cards Hackers claim to have 2.2 million card details April 30, 2011 London The Guardian Charles Arthur 2011-04-29 2024-05-22 https://web.archive.org/web/20240522150145/https://www.theguardian.com/technology/blog/2011/apr/29/playstation-network-hackers-credit-cards live however, they were yet to be linked to the incident. Sony said that the CSC codes requested by their services were not stored,http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/ Q&A #1 for PlayStation Network and Qriocity Services – PlayStation Blog blog.us.playstation.com 2011 16 May 2011 14 May 2011 https://web.archive.org/web/20110514224707/http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/ live but hackers may have been able to decrypt or record credit card details while inside Sony's network. On May 5, a letter from Sony Corporation of America CEO and President Sir Howard Stringer emphasized that there had been no evidence of credit card fraud and that a $1 million identity theft insurance policy would be available to PSN and Qriocity users. See also Criticism of Sony References Video games Category:2011 crimes PlayStation Network Category:PlayStation Network Network Category:Sony Interactive Entertainment Category:2010s internet outages