Originally posted by Mr. Boffo

---

I'm going to guess "stolen laptop that stupidly had all customer data on it".

---

---

Because the freebie content will be different by region, Sony was hesitant to put a price on it, but Hirai estimated "a few thousand yen" worth of free downloads. So like $20-25 or so?

---

---

Sony guesses that hackers got into the network through an "application server," through which they were then able to get into the database servers and grab data.

...

The vulnerability in the web server was a vulnerability known about that particular type of server, one of the execs on stage said.

---

---

A reporter asked what the purpose of the "intrusion" was. Hirai: "For the past month and a half, we've experienced attacks on various Sony systems. We have yet to identify a direct relationship with a group." Speculation about the objective: "We are not in a position to say one way or the other." That same reporter asked if passwords were encrypted. I believe (translation not being perfect) that Hirai said they were not.

---

Originally posted by El Nastio

---

It gets better. Click Here (joystiq.com) Sony Online Entertainment shuts down their service temporarily after finding "an issue". For those who don't know, this is what they use for DCU Online.

The hubris of Sony is amazing. After the debacle listed above, SOE goes up and says "oh, we're totally fine and weren't affected.

Oops.

"SCEA PR director Patrick Seybold states in the FAQ that the company is "moving our network infrastructure and data center to a new, more secure location, which is already underway."

The implication is was physical security that caused the PSN hacks. So unless SOE and PSN share the same location, they lied. Again.

Unless they're repealing that and going with the Application Server and poor encryption schemes.

---

---

Following up on this morning's news that Sony Online Entertainment servers were offline across the board, Japanese newspaper Nikkei reports (via BGR) that the company has lost 12,700 customer credit card numbers as the result of an attack. The company apparently took SOE servers offline after learning of the attack last evening, but has yet to issue a statement confirming that customer information has been lost.

Of the 12,700 total, 4,300 are alleged to be from Japan, while the remainder's origins are unknown. The report also notes that most of the numbers are said to be from expired cards, which Engadget posits could mean this was simply stolen data from an old backup.

---

---

Sony’s Response to the U.S. House of Representatives

---

---

Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack.

We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named “Anonymous” with the words “We are Legion.”

---

Originally posted by thecubsfan

---

Edit: the actual letter is worth reading.

---

Originally posted by the letter

---

Sony Network Entertainment America is committed to helping its customers protect their personal data and will offer its U.S. account holders complimentary identity theft protection services.

---

Originally posted by the letter

---

Central components of the "Welcome Back" program will include:

-All consumers coming back to the PlayStation Network will be provided with 30 days of free membership in the PlayStation Plus premium subscription service.

---

Originally posted by BoromirMark

---

Not to divert any of the deserved criticism about Sony's incompetence, but I'd like to see this level of vitriol and cynicism focused on the hackers and pirates who are the ones who committed the crime and now hold many people's financial information hostage.

---

Originally posted by wmatistic

---

All I do know is that Sony SHOULD have had security in place to prevent this from ever happening.

---

Originally posted by wmatistic

---

Not to mention the fact that they still haven't been able to figure out what was taken or correct the problem and get the systems back up.

---

---

"On a few of the security mailing lists that I read, there were discussions that individuals who work in security and participate in the Sony Network had discovered several months ago, while they were examining the protocols on the Sony Network to examine how the games worked, they had discovered that the [PlayStation] Network servers were hosted on Apache Web servers--that's that form of software. But they were running on very old versions of Apache software that were unpatched and had no firewall installed, and so these were potentially vulnerable. They had reported these in an open forum that was monitored by Sony employees, but had seen no response and no change or update to the software. … [And] that was two to three months from when the break-ins occurred."

---

---

I know some believe we should have notified our customers earlier than we did. It’s a fair question. As soon as we discovered the potential scope of the intrusion, we shut down the PlayStation Network and Qriocity services and hired some of the best technical experts in the field to determine what happened. I wish we could have gotten the answers we needed sooner, but forensic analysis is a complex, time-consuming process. Hackers, after all, do their best to cover their tracks, and it took some time for our experts to find those tracks and begin to identify what personal information had — or had not — been taken.

..

In the last few months, Sony has faced a terrible earthquake and tsunami in Japan. But now we are facing a very man-made event – a criminal attack on us — and on you — and we are working with the FBI and other law enforcement agencies around the world to apprehend those responsible.

---