QuoteDear valued SOE Customers,
We have had to take the SOE service down temporarily. In the course of our investigation into the intrusion into our systems we have discovered an issue that warrants enough concern for us to take the service down effective immediately. We will provide an update later today (Monday).
This morning, SOE brought down ALL websites and ALL games they run. Right now, I'm hoping no one got ahold of everyone's credit card information.
Hmmm, maybe they shouldn't have laid off all those people recently?
Actually heard that is what the cause of all this has been. Former security people who tried pointing out holes and got ignored. Later fired , they are the ones who hacked the PSN and caused all this to "prove a point" ... no clue how reliable that is , just what I have been hearing everywhere.
Hum, the PSN attack last week was not just to 'prove a point', a large chunck (millions) of accounts were hacked, personal information stolen including credit card numbers and password hashes. SOE network being taken down as well worries me, means the whole Sony network has been compromised at some level...
Janthos, heard the same, thus the comment.
Titia, supposedly, the two data networks are housed in the same building, but aren't connected at all. What affects one shouldn't affect the other. Unless, of course, they both use the same security and thus are vulnerable to the same attacks.
I just wish they would be a little more forthcoming with some information. At the very least, hourly updates that say "No new info, still working on it, no ETA yet" would be better than silence.
On one hand, I hope things aren't compromised. It would be a huge PR blow and possibly a bigger financial blow to SOE, and that's not mentioning potentionally MILLIONS of customers having their personal and financial data exposed to who knows who.
On the other, I was hoping to get some good EQ2 time in today and this puts a huge cramp in my plans for the day. Hopefully they can get things pulled together soon.
Many people have been saying that they want double/triple XP, free Station Cash, etc., and while I would be in favor of SOE doing a "Make Good" event for this, I want them to get their security up to snuff first.
I thought they indeed were both separated but the SOE network being breached after the PSN one makes me really wonder. As Sony most likely doesn't own the datacenters it uses and seeing how we sometimes discover unexpected 'configurations' in the one my company outsourced our servers in... I'm simply not at ease.
Interestingly enough, the whole network supporting P99 (EQEmulator) seems to also be completely down as no servers is listed at all (never seen this so far).
I hate to say it, but with all the crap Sony has dished out lately, then PSN doing down for days, I sort of saw this one coming. I hope none of you that still play SOE games are adversely affected. I've changed my credit card number for other reasons since cancelling my SOE account, but it might be something you all want to think about.
Oh, this is great...
QuoteAs previously announced, we have been conducting an ongoing, thorough investigation stemming from the cyber attack in April and promised to notify you should there be any changes to the situation.
A press release was issued today outlining these details. We will promptly send a customer service notification via email to all of our impacted account holders whose customer data may have been stolen as a result of an illegal intrusion on our systems. This information was discovered less than 24 hours ago and in response, we took down our services until we could verify their security.
SOE is committed to delivering secure, stable and entertaining games for players of all ages and we're working around the clock to ensure this situation is resolved as quickly as possible. We deeply regret the inconvenience this has caused and appreciate your continued patience and feedback.
Sincerely,
Sony Online Entertainment
QuoteCUSTOMER SERVICE NOTIFICATION
May 2, 2011
Dear Valued Sony Online Entertainment Customer:
Our ongoing investigation of illegal intrusions into Sony Online Entertainment systems has discovered that hackers may have obtained personal customer information from SOE systems. We are today advising you that the personal information you provided us in connection with your SOE account may have been stolen in a cyber-attack. Stolen information includes, to the extent you provided it to us, the following: name, address (city, state, zip, country), email address, gender, birthdate, phone number, login name and hashed password.
Customers outside the United States should be advised that we further discovered evidence that information from an outdated database from 2007 containing approximately 12,700 non-US customer credit or debit card numbers and expiration dates (but not credit card security codes) and about 10,700 direct debit records listing bank account numbers of certain customers in Germany, Austria, Netherlands and Spain may have also been obtained. We will be notifying each of those customers promptly.
There is no evidence that our main credit card database was compromised. It is in a completely separate and secured environment.
We had previously believed that SOE customer data had not been obtained in the cyber-attacks on the company, but on May 1st we concluded that SOE account information may have been stolen and we are notifying you as soon as possible.
We apologize for the inconvenience caused by the attack and as a result, we have:
1) Temporarily turned off all SOE game services;
2) Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and
3) Quickly taken steps to enhance security and strengthen our network infrastructure to provide you with greater protection of your personal information.
We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.
For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When SOE's services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your Station or SOE game account name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.
To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports. We are providing the following information for those who wish to consider it:
U.S. residents are entitled under U.S. law to one free credit report annually from each of the three major credit bureaus. To order your free credit report, visit www.annualcreditreport.com (http://www.annualcreditreport.com) or call toll-free (877) 322-8228.
We have also provided names and contact information for the three major U.S. credit bureaus below. At no charge, U.S. residents can have these credit bureaus place a "fraud alert" on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. This service can make it more difficult for someone to get credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it also may delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any one of the agencies listed below.
Experian: 888-397-3742; www.experian.com; (http://www.experian.com;) P.O. Box 9532, Allen, TX 75013
Equifax: 800-525-6285; www.equifax.com; (http://www.equifax.com;) P.O. Box 740241, Atlanta, GA 30374-0241
TransUnion: 800-680-7289; www.transunion.com; (http://www.transunion.com;) Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790
You may wish to visit the web site of the U.S. Federal Trade Commission at www.consumer.gov/idtheft (http://www.consumer.gov/idtheft) or reach the FTC at 1-877-382-4357 or 600 Pennsylvania Avenue, NW, Washington, DC 20580 for further information about how to protect yourself from identity theft. Your state Attorney General may also have advice on preventing identity theft, and you should report instances of known or suspected identity theft to law enforcement, your State Attorney General, and the FTC. For North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; telephone (877) 566-7226; or www.ncdoj.gov (http://www.ncdoj.gov). For Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202; telephone: (888) 743-0023; or www.oag.state.md.us (http://www.oag.state.md.us).
We are committed to helping our customers protect their personal data and we will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in regions in which such programs are commonly utilized.
We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please contact us at 1 (866) 436-6698 should you have any additional questions.
Sincerely,
Sony Online Entertainment LLC
And the press release that came out today:
QuoteFOR IMMEDIATE RELEASE
SONY ONLINE ENTERTAINMENT ANNOUNCES
THEFT OF DATA FROM ITS SYSTEMS
Breach Believed to Stem From Initial Criminal Hack of SOE
Tokyo, May 3, 2011 - Sony Corporation and Sony Computer Entertainment announced today that their ongoing investigation of illegal intrusions into Sony Online Entertainment LLC (SOE, the company) systems revealed yesterday morning (May 2, Tokyo time) that hackers may have stolen SOE customer information on April 16th and 17th, 2011 (PDT). SOE is based in San Diego, California, U.S.A.
This information, which was discovered by engineers and security consultants reviewing SOE systems, showed that personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007. The information from the outdated database that may have been stolen includes approximately 12,700 non-U.S. credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain.
With the current outage of the PlayStation® Network and Qriocity™ services and the ongoing investigation into the recent attacks, SOE had also undertaken an intensive investigation into its system. Upon discovery of this additional information, the company promptly shut down all servers related to SOE services while continuing to review and upgrade all of its online security systems in the face of these unprecedented cyber-attacks.
On May 1, Sony apologized to its customers for the inconvenience caused by its network services outages. The company is working with the FBI and continuing its own full investigation while working to restore all services.
Sony is making this disclosure as quickly as possible after the discovery of the theft, and the company has posted information on its website and will send e-mails to all consumers whose data may have been stolen.
The personal information of the approximately 24.6 million SOE accounts that was illegally obtained, to the extent it had been provided to SOE, is as follows:
name
address
e-mail address
birthdate
gender
phone number
login name
hashed password.
In addition to the information above, the 10,700 direct debit records from accounts in Austria, Germany, Netherlands and Spain, include:
bank account number
customer name
account name
customer address.
SOE will grant customers 30 days of additional time on their subscriptions, in addition to compensating them one day for each day the system is down. It is also in the process of outlining a "make good" plan for its PlayStation®3 MMOs (DC Universe Online and Free Realms). More information will be released this week.
Additionally, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.
Sony Online Entertainment LLC (SOE) has been a recognized worldwide leader in massively multiplayer online games since 1999. Best known for its blockbuster hits and franchises, including EverQuest®, EverQuest® II, Champions of Norrath®, PlanetSide®, Free Realms®, Clone Wars Adventures™, and DC Universe Online™, SOE creates, develops and provides compelling online entertainment for virtually all platforms, including the PlayStation®3 Computer Entertainment System, Personal Computer, mobile and social networks. SOE is building on its proven legacy and pioneering the future of the interactive entertainment space through creative development and inspired gameplay design for audiences of all ages. To learn more, visit www.soe.com (http://www.soe.com).
For more information and update about the SOE services, please visit www.soe.com/securityupdate (http://www.soe.com/securityupdate).
About Sony Corporation
Sony Corporation is a leading manufacturer of audio, video, game, communications, key device and information technology products for the consumer and professional markets. With its music, pictures, computer entertainment and on-line businesses, Sony is uniquely positioned to be the leading electronics and entertainment company in the world. Sony recorded consolidated annual sales of approximately $78 billion for the fiscal year ended March 31, 2010. Sony Global Web Site: http://www.sony.net/ (http://www.sony.net/)
About Sony Computer Entertainment Inc.
Recognized as the global leader and company responsible for the progression of consumer-based computer entertainment, Sony Computer Entertainment Inc. (SCEI) manufactures, distributes and markets the PlayStation® game console, the PlayStation®2 computer entertainment system, the PSP® (PlayStation®Portable) handheld entertainment system and the PlayStation®3 (PS3®) system. PlayStation has revolutionized home entertainment by introducing advanced 3D graphic processing, and PlayStation 2 further enhances the PlayStation legacy as the core of home networked entertainment. PSP is a handheld entertainment system that allows users to enjoy 3D games, with high-quality full-motion video, and high-fidelity stereo audio. PS3 is an advanced computer system, incorporating the state-of-the-art Cell processor with super computer like power. SCEI, along with its subsidiary divisions Sony Computer Entertainment America Inc., Sony Computer Entertainment Europe Ltd., and Sony Computer Entertainment Korea Inc. develops, publishes, markets and distributes software, and manages the third party licensing programs for these platforms in the respective markets worldwide. Headquartered in Tokyo, Japan, SCEI is an independent business unit of the Sony Group.
Hmmmmmmmmmmmmmmm. Thanks for the heads up, Way. I will be keeping an interested eye on any updates. This makes me a little grumpy. :knuppel2:
I got one of those e-mails as well, but Gmail filtered it to spam since it was from Inoyvox.com or something. The one with all the credit bureau information. The links are clones of what they should be so don't go using them to check your credit info.
Apparently most of the affected SOE accounts are overseas and had expired CC info, but still, you should keep an eye on your card statements to be safe. The last press conference covered in Yahoo suggested about 25 million PSN and SOE accounts were compromised.
Quote from: Kelora on May 03, 2011, 07:55:08 AM
I got one of those e-mails as well, but Gmail filtered it to spam since it was from Inoyvox.com or something. The one with all the credit bureau information. The links are clones of what they should be so don't go using them to check your credit info.
Founded in 1998, Innovyx specializes in providing one-to-one integrated digital marketing solutions to advertising and marketing agencies and global 2000 enterprises. These solutions enable business professionals to create, deliver and analyze direct marketing campaigns and customer communications programs.
Innovyx provides a complete range of digital marketing solutions, including subscriber acquisition; deliverability services; response management; program data hosting and analytics; and permission management. Its proprietary digital marketing platform, Dialogue 1to1™, enables extensive testing and optimized delivery of richly customized campaigns using a wide range of content formats, including HTML and rich media.
Specialties
Email Marketing, Email Service Provider, Email Strategy, Email Analytics
Found here: http://www.linkedin.com/company/innovyx (http://www.linkedin.com/company/innovyx)
----------------------------------------------
My guess is SOE is using them to deliver the "ALL YOUR BASE IZ STOLUN!! OMG!!" emails to the subscriber base while they have all their websites and stuff down.
I guess it is legit then. Deleted mine without looking at it too closely. If Gmail says it's phishing it all the links are blocked, and I tend to trust Gmail to know the difference.
Well, I'm not sure what to believe about anything at this point. EQ2wire.com says they are phishing emails, even though the site they point you to is one that has done business with Sony before. ???
I never clicked on any of the links. It's still in my inbox folder, having arrived in my Spam folder initially, but I've had good emails end up there before.
<sighs>
Oh, least I forget, the newest update from SOE, courtesy of Facebook.
QuoteSOE
We're working as hard as we can to get the servers up as soon as possible, but have no ETA at this time.
Not watching my CC statement that closely , if something does happen on it SOE will have an interesting time ... seeing as my account had already been canceled. So anything popping up on mine , SOE can have a fun time paying off
Hrm.
My account is canceled. And I have received nothing in email.
Here's hoping I am in the clear.
Keeping an eye on this and I really really appreciate your posting all the information Wayena. --hugs--
Got the email this morning. Exact copy of the press release Wayena posted (with the exception of the embedded links as Kelora noted) and which has been posted on the SOE page you are redirected to when trying to visit any SOE site. SOE also put up this security update, which addresses Innovyx. I'm not worried about this particular email being a phishing risk. And since I'm not an overseas customer, I'm not particularly concerned about my CC info until I'm informed otherwise. Further, out of the nearly 13,000 CC numbers SOE has confirmed stolen from their databases, only 900 were reportedly active.
I'd expect everyone
should be seeing the aforementioned email. They have a responsibility to ensure they've done everything possible to communicate this issue. I don't expect everyone to be seeing it at the same time, though. I'm guessing they are being delivered in batches--24 million accounts is a lot of accounts requiring an email notification.
QuoteSECURITY UPDATE
As previously announced, we have been conducting an ongoing, thorough investigation stemming from the cyber attack in April and promised to notify you should there be any changes to the situation.
A press release was issued May 2, 2011 outlining these details. We are sending customer service notifications via email to all of our impacted account holders whose customer data may have been stolen as a result of an illegal intrusion on our systems. These emails will be sent by Innovyx, our third party email distributor, and will contain either 'soe.innovyx.net' or 'soe.sony.com' in the sender field.
SOE is committed to delivering secure, stable and entertaining games for players of all ages and we're working around the clock to ensure this situation is resolved as quickly as possible. We deeply regret the inconvenience this has caused and appreciate your continued patience and feedback.
Sincerely,
Sony Online Entertainment
So the email was legit, huh. So hard to tell now-a-days.
Anyway, newest Facebook post:
QuoteSOE
Hey folks, in response to many inquiries, we wanted to reassure you that all of your characters and items are safe and awaiting your return. We continue to work on the issues as fast as we can, but unfortunately the servers will not come up today. Thank you for your continued patience; we expect to be back up very soon.
QuoteFrom MSNBC.com:
Sony has hired outside investigators to help clean its networks and catch the people behind a massive breach that exposed the personal data of more than 100 million video game users.
The Japanese electronics giant has retained a team from privately held Data Forte that is led by a former special agent with the U.S. Naval Criminal Investigative Service to work alongside the FBI agents, who are also probing the matter.
Sony said on Tuesday that it has also brought on cyber-security detectives from Guidance Software and consultants from Robert Half International Inc.'s subsidiary Protiviti to help with the clean-up.
A Toronto law firm on Tuesday launched a C$1 billion ($1.05 billion) proposed class-action suit against Sony for breach of privacy, naming a 21-year-old PlayStation user from Mississauga, Ontario, as lead plaintiff. The damages would cover the cost of credit monitoring services and fraud insurance for two years, the firm, McPhadden Samac Tuovi LLP, said in a statement.
QuoteFrom SignOnSanDiego.com, the website of the San Diego Union-Tribune newspaper.
Customers of San Diego-based Sony Online Entertainment must watch out for "spear phishing" scams after a hacker may have gained access to personal information on 24.6 million accounts, including email addresses and passwords.
Privacy experts say cyber criminals could have enough information to send highly customized emails or postal letters — or make phone calls — that will appear to come from Sony in hopes of tricking customers into revealing more sensitive information — such as credit card or Social Security numbers.
Sony Online Entertainment urged its customers to be "especially aware" of these scams. "Sony will not contact you in any way, including email, asking for your credit card number, Social Security number or other personal information," the company said in a letter to customers posted on its Web site. "If you are asked for this information, you can be confident Sony is not the entity asking."
Sony Online Entertainment, which makes video games such as the EverQuest series that users play online, abruptly shut down its network on Monday after the breach was discovered. The breach did not expose customer credit card numbers in the U.S. But it did possibly reveal names, addresses, email, birth dates, gender, phone numbers, login names and passwords.
The PlayStation network breach came from an attack on a data center in San Diego. Taina Rodriguez, a Sony Online Entertainment spokeswoman, declined to say if PlayStation and Sony Online Entertainment shared the same data center.
"Our servers are different from the PSN servers," she said. "We are operated separately. But since we're both under the Sony umbrella, there is a degree of architecture that overlaps."
Rodriguez added that Sony Online Entertainment's network would be shut down until Friday and possibly longer. The company has contacted the FBI to investigate the attack.
QuoteFrom MSNBC.com:
A U.S. House of Representatives subcommittee is demanding answers from Sony after private information from some 102 million personal accounts was taken by hackers.
In a letter written by the Congressional Subcommittee on Commerce, Manufacturing and Trade and addressed to Sony chairman Kazuo Hirai, representatives asked the company to answer a list of 13 questions related to the hacking of Sony's PlayStation Network.
The Congressional committee has demanded answers about the PlayStation Network breach only perhaps because news of the Sony Online Entertainment breach wasn't released until Monday afternoon.
Yay for more info. Sorta.
QuoteMay 4, 2011
We want to thank you again for your patience as we work to get the SOE services back up and running. We received several questions and comments relating to the criminal attack to our network and would like to address some of the most common questions today. We are also going to continue to post updates to this website with new information as they become available.
We appreciate your continued patience and feedback.
Thank you,
Sony Online Entertainment
When will SOE's services be back online?
We have been working around the clock to restore operations as quickly as possible, and we expect to have some of our games and services up and running soon. However, we want to be very clear that we will only restore operations when we believe that the network is secure.
How is the SOE intrusion related to the PSN/Qriocity intrusion? Was this a second attack on SOE?
While the two systems are distinct and operated separately, given that they are both under the Sony umbrella, there is some degree of overlap in design. The attacks were similar in nature. This is NOT a second attack; new information has been discovered as part of our ongoing investigation into the criminal attack in April.
How is SOE planning to notify customers whose data may have been stolen?
We are sending out customer service notification emails to the email addresses we have on file for the accounts that were affected. These emails will be sent by Innovyx, our third party email distributor, and contained either 'soe.innovyx.net' or 'soe.sony.com' in the sender field.
SOE initially thought no data was extracted, what changed?
Essentially the perpetrators used sophisticated means not only to access the data, but also to cover their tracks. We committed to continue the investigation and in doing so, uncovered further information that we did not have when we initially believed the data was not stolen.
QuoteToday, the Subcommittee on Commerce, Manufacturing and Trade of the U.S. House of Representatives Committee on Energy and Commerce held a hearing in Washington, DC on "The Threat of Data Theft to American Consumers."
Kazuo Hirai, Chairman of the Board of Directors of Sony Computer Entertainment America, submitted written answers to questions posed by the subcommittee about the large-scale, criminal cyber-attack we have experienced. We wanted to share those answers with you.
In summary, we told the subcommittee that in dealing with this cyber attack we followed four key principles:
1.Act with care and caution.
2.Provide relevant information to the public when it has been verified.
3.Take responsibility for our obligations to our customers.
4.Work with law enforcement authorities.
We also informed the subcommittee of the following:
•Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack.
•We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named "Anonymous" with the words "We are Legion."
•By April 25, forensic teams were able to confirm the scope of the personal data they believed had been taken, and could not rule out whether credit card information had been accessed. On April 26, we notified customers of those facts.
•As of today, the major credit card companies have not reported any fraudulent transactions that they believe are the direct result of this cyber attack.
•Protecting individuals' personal data is the highestpriority and ensuring that the Internet can be made secure for commerce is also essential. Worldwide, countries and businesses will have to come together to ensure the safety of commerce over the Internet and find ways to combat cybercrime and cyber terrorism.
•We are taking a number of steps to prevent future breaches, including enhanced levels of data protection and encryption; enhanced ability to detect software intrusions, unauthorized access and unusual activity patterns; additional firewalls; establishment of a new data center in an undisclosed location with increased security; and the naming of a new Chief Information Security Officer.
We told the subcommittee about our intent to offer complimentary identity theft protection to U.S. account holders and detailed the "Welcome Back" program that includes free downloads, 30 days of free membership in the
PlayStation Plus premium subscription service; 30 days of free service for Music Unlimited subscribers; and extending PlayStation Plus and Music Unlimited subscriptions for the number of days services were unavailable.
We are working around the clock to have some PlayStation Network services restored and we'll be providing specific details shortly. We hope this update is helpful to you, and we will continue to keep you posted as we work to restore our network and provide you with both the entertainment and the security you deserve.
By the by, I went back and made some of these quoted statements bigger. They were a little small on my screen and I had to lean in to read them. Figured others might have the same issue.
Fascinating stuff. Thanks for the roundup, Way.
Today's non-update from SOE's facebook page:
QuoteWe regret that we were unable to bring services back online today, and continue to work hard on the issue!
QuoteAfter initially going on the record stating that Anonymous, the evangelist hacker group, had no involvement in the actual hack of the PlayStation Network (and by extension the SOE network), Sony have now pointed the finger for a different reason.
In a letter to congress, Sony has posited that the very disruptive flooding/attacks on Sony servers in retaliation for the George Hotz lawsuit was a sufficient distraction to leave a much larger window for hackers to enter Sony systems and leave undetected. Sony has suggested that had the coordinated denial-of-service attacks not happened, a compromise of their servers would have been more easily detected and possibly thwarted.
QuoteFrom BBCNews:
Sony has blamed the online vigilante group Anonymous for indirectly allowing the security breach that allowed a hacker to gain access to the personal data of more than 100m online gamers.
In a letter to the US Congress, Sony said the breach came at the same time as it was fighting a denial-of-service attack from Anonymous.
Denial-of-service attacks take servers down by overwhelming them with traffic.
The online vigilante group has denied being involved in the data theft.
Sony said that it had been the target of attacks from Anonymous because it had taken action against a hacker in a federal court in San Francisco.
In the letter to members of the House Commerce Committee, Kazuo Hirai, chairman of Sony Computer Entertainment America, defended the way that his company had dealt with the breach.
Sony discovered a breach in its Playstation video game network on 20 April but did not report it to US authorities for two days and only informed consumers on 26 April.
"Throughout the process, Sony Network Entertainment America was very concerned that announcing partial or tentative information to consumers could cause confusion and lead them to take unnecessary actions if the information was not fully corroborated by forensic evidence," the letter said.
http://eq2wire.com/2011/05/05/sony-anonymous-didnt-hack-us-but-made-it-easy/#more-9021 (http://eq2wire.com/2011/05/05/sony-anonymous-didnt-hack-us-but-made-it-easy/#more-9021)
QuoteFrom Consumerist.com:
In congressional testimony this morning, Dr. Gene Spafford of Purdue University said that Sony was using outdated software on its servers — and knew about it months in advance of the recent security breaches that allowed hackers to get private information from over 100 million user accounts.
According to Spafford, security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed." The issue was "reported in an open forum monitored by Sony employees" two to three months prior to the recent security breaches, said Spafford.
Quote
From EQ2wire.com:
Although SOE games and services remain offline, readers have noticed some curious changes.
Most obvious is that http://www.EverQuest2.com/ (http://www.everquest2.com/) and http://www.SOE.com/ (http://www.soe.com/) are no longer resolving correctly and presenting an error message. The secure version of https://www.SOE.com/ (https://www.soe.com/) (notice the additional 's') is however online and presenting the same updates we were provided with yesterday.
UPDATE: http://www.SOE.com (http://www.soe.com) is now resolving properly to https://www.SOE.com/. (https://www.soe.com/.)
As there has been no announcement from SOE about what the steps will be for users to change their passwords, login, secure their accounts, and start playing again (indeed SOE communication has been nothing short of atrocious — perhaps due to the stipulations of lawyers), it's unclear what conclusions we should draw from some servers being accessible while others are not. Is this a sign that things are about to open back up, or just a sign that SOE platform aren't properly securing websites in preparation for the service restoration?
Shabutie did some checks of the DNS information present on different SOE game websites (FreeRealms.com, EverQuest2.com, etc.) and has noticed that they no longer all point to SOE's main website. This may indicate that things are opening up soon, but without confirmation from anyone at SOE, all we can do is guess.
Although Facebook and Twitter remain mum (their last update was 12 hours ago), maybe today's the day? Although 4 days is not a terribly long outage considering the complexity of the security breach, the lack of communication has really exacerbated this and made the outage feel a lot longer than it has been. More as we have it...
Another attack on Sony coming this weekend? I hope not. I'm jonesing for my fix as it is and Dungeon and Dragons Online (while a nice diversion) just isn't cutting it.
Quote
From EQ2wire.com:
When I first encountered this story, I had little interest in reporting it at all. A blogger, however well-intentioned, taking the ramblings of a few script kiddies in an IRC chatroom seriously and posting it as a "CNET Exclusive" seems hardly newsworthy. Journalistic integrity must have some minimum standard. We report things all the time which aren't from SOE or a press release, but they have SOME basis in fact.
However the story that an attack is planned for this weekend seems to have gotten some traction and is now making the rounds and being quoted by larger news organizations as "reported by CNET". So we feel we should address it. Erica Ogg, CNET blogger, has posted an article positing that a third attack on Sony services is being planned for this weekend.
A group of hackers says it is planning another wave of cyberattacks against Sony in retaliation for its handling of the PlayStation Network breach.
Her source?
An observer of the Internet Relay Chat channel used by the hackers told CNET today that a third major attack is planned this weekend against Sony's Web site. The people involved plan to publicize all or some of the information they are able to copy from Sony's servers, which could include customer names, credit card numbers, and addresses, according to the source. The hackers claim they currently have access to some of Sony's servers.
Blogging without sources or attribution is just speculation and should be taken as such. The article reads as if the information has been confirmed with secondary sources. It hasn't.
Quote
From SOE's Facebook page as of 9:13 pm EDT:
We wanted to let you know that our games will not be up this weekend. We are working around the clock to get our services back up and running soon. Thank you for your continued patience and support.
Quote
TOKYO, May 7 (Reuters) - Sony said on Saturday it had removed from the Internet the names and partial addresses of 2,500 sweepstakes contestants that had been stolen by hackers and posted on a website, and said it did not know when it could restart its PlayStation video games network. The company, under fire since hackers accessed personal data from about 100 million user accounts of its PlayStation Network and PC-based online gaming services, said in a statement details posted on the inactive website also included three unconfirmed e-mail addresses.
The data came from customers who entered a 2001 product sweepstakes contest. The list did not include information on credit cards, social security numbers or passwords.
"The website was out of date and inactive when discovered as part of the continued attacks on Sony," Sony said, adding that the company took the website down shortly after finding out about the postings on Thursday. Sony Chief Executive Officer Howard Stringer apologised on Friday to users of the firm's PlayStation Network and other online services, breaking his silence on the massive data breach. The company said last Sunday that it would begin restoring services within the week but a spokeswoman said on Saturday this would not be possible, and that no date had been fixed for when services would resume.
The incident may prove to be a significant setback for a company looking to recover after being outmanoeuvred by Apple in portable music and Samsung Electronics in flat-screen TVs.
In video games, it faces a tough fight with Nintendo's Wii game console and Microsoft's Xbox.
"This wait is becoming so tedious. I know there needs to be a lot of testing, but it is really getting annoying. I am seriously considering changing to the Xbox," said message posted by a user called Cryonic UCX on the U.S. PlayStation blog.
"I LOVE my PlayStation, but Sony is not doing well in the online. Sony, you need to step your game up!"
On Friday, Sony shares ended 2.3 percent lower in a broader market down 1.5 percent, extending its total losses to about 6 percent since it revealed the breach. The Nikkei is up around 3 percent over the same period.
Sony issued its first warning on the PlayStation break-in a week after it detected a problem with the network on April 19, infuriating many users around the world. Sony said it needed time to work out the extent of the damage.
The hackers have not been identified, but Internet vigilante group Anonymous, which had claimed responsibility for previous attacks on Sony and other corporations, denied it was behind the data theft. [ID:nN05150202]
The group's statement came after Sony said Anonymous was indirectly responsible for the attack on the company.
Sony, which is set to report its annual earnings on May 26, has yet to specify the financial effect of the network breach. (Reporting by Isabel Reynolds, Chisa Fujioka; Editing by Nick Macfie)
QuoteSony misses promised PlayStation Network and Qriocity restoration date, begs for more patience
By Darren Murph posted May 7th 2011 3:18AM
Whoops. If you'll recall, Sony held what can only be described as an emergency press event in Japan a week ago in order to issue a number of assurances about the resumption of service as it relates to the PlayStation Network and Qriocity. Seven days later, things are still as dead as they were pre-Cinco de Mayo. This evening, the company's Senior Director of Corporate Communications Patrick Seybold punched out a quick update to let the world know that they could actually leave the house and find something else to entertain 'em -- like it or not, PSN isn't coming back online today. The reason? On May 1st, Sony was apparently "unaware of the extent of the attack on Sony Online Entertainment servers," and now, it's spinning its wheels in order to restore security on the network and "ensure" that user data is safe. Mr. Seybold seems to understand that you're overly anxious about getting back into the swing of things, and he's even going so far as to ask your trust that Sony's doing "everything [it] can" to get the lights blinking once more. Oh, and if you were planning on visiting that source link just to find the new ETA... don't. Sony's planning to update you "as soon as it can."
Yeah the gossip that's been going around in the guide forums is that SOE probably won't be up and running till the end of May, so give it another two weeks or so...
In the meantime, a lot of the roleplayers are taking refuge in www.raven-mythic.com (http://www.raven-mythic.com) where there's been a few chat rooms set up for people to communicate as well as the forums.
Quote
Although we are unsurprised — restoration of services even by the end of the week now seems unlikely — we bring you the latest news from SOE's Facebook page as of May 9, 1:55 p.m. PDT:
SOE services will remain offline today. We continue to work diligently to bring things back as quickly as possible and appreciate your continued patience.
May 11th Facebook update:
Quote
All SOE games and sites are still offline as of May 11th and will not return today. Thank you again for your continued patience and support as we diligently work on these issues. All houses requiring rent will have one month added free to help offset any costs incurred during this outage. More information on SOE's "Make Good" plan to come!"
QuoteMay 12, 2011
We thank you for your patience as we continue to work around the clock to restore our game services. We know this has been a frustrating time for you and appreciate your understanding as we work to confirm the security of our network.
In light of the recent outage of Sony Online Entertainment's game services due to April's cyber-attack, we are committed to compensating our loyal player base for the inconvenience caused by the data breach and lost game time while we improve our security measures.
We are currently in the process of an extensive upgrade to our network to further protect your information from future attacks. It will likely be at least a few more days before we restore our services, and when we come back online, here is what you can expect for each of our game services.
First and foremost, all impacted players will receive 30 days of game time added to the end of the current billing cycle in addition to one day for each day the system is down. Additionally, many games are offering a variety of in-game items and special events to welcome players back once our services resume (per the outline below). This is true for both PC and PlayStation®3 computer entertainment system based products.
» DC Universe™ Online: Batman™ and Two-Face™ Inspired Masks and 30 Marks of Distinction
» Free Realms®: Free daily items (7 to collect)
» Clone Wars Adventures™: Count Dooku v2 Outfit
» EverQuest®: A series of events, including Double XP, Double Rare Mob Spawns and Double Faction Gains
» EverQuest II and EverQuest II Extended: A series of events, including Double XP, Double Guild XP, Loot Bonanza, and City Festivals
» Vanguard: Saga of Heroes®: A series of Double XP events
» Star Wars Galaxies™: Bounty Hunter Statue, a miniature model of Boba Fett's ship, the Slave I™
» Magic: The Gathering – Tactics™: Four of each of these spells: "Ivory Mask", "Duress" and "Angelheart Vial", plus 500 Station Cash
» PoxNora®: Limited edition Carrionling, Welcome Back 5K Gold Award Tournaments and two Draft Tournaments, plus 500 Station Cash
For our lifetime subscribers, we'll grant in-game currency; specifically 20,000 coins for Free Realms, 7,500 Galactic Credits for Clone Wars Adventures and 10 Marks of Distinction for DC Universe Online (in addition to the items listed above).
And finally, our Station Access subscribers will receive 500 Station Cash, in addition to the subscription time and items listed above.
Additionally, we announced today that SOE will provide its U.S.-based Station Account holders with complimentary enrollment in an identity theft protection program through Debix, one of the industry's most reputable identity protection firms. For Station Account holders who live outside the U.S., SOE will be offering similar programs, if and as available, and will provide details as they're confirmed for each country or territory.
We continue to work around the clock to restore SOE's services and thank you for your continued patience as we complete our investigation of this criminal attack.
Thank you,
Sony Online Entertainment
wow. Can't say they aren't trying, huh?
Well it's either that or facing a PR nightmare (as if it wasn't already the case, come to thing about this) and closing shop. Sony has often been criticized for not compensating important downtimes in the past.
Do remember though, that other then the extended time added to the accounts, the rest is just pixels.
They could offer a Billion Sony Cash to everyone and it doesn't actually effect their bottom line.
Not compensating anything would have most PSN player flee to either M$ or Nintendo. Consoles are one of the last area where Sony still can hold its rank (they just don't in TV or smartphones), they can't affort loosing these player or yes, it will affect them hard (their stock keeps falling, 7% down over last month, 20% last three).
As for SOE, giving a free month to all plus free days (and I agree SC is monkey money but it's still a form of income for them) and topping this with investement to get the infrastructure secured... it's free play time when they don't get returns on investment and hit their reserve. Not that I believe this will run them to fill a chapter 11 but I do hope this won't affect future develpments (like GUs or EQ3).
QuoteSONY ONLINE ENTERTAINMENT RESTORES GAME SERVICES
Services Return Following Implementation of Increased Security Measures; Consumer Data Protection a Full-Time, Company-Wide Commitment
SAN DIEGO, May 14, 2011 - Sony Online Entertainment LLC (SOE) announced today that restoration of its game services will begin today. The phased restoration will include the return of nearly all of SOE's portfolio of online games, the reinstatement of SOE's game forums and websites, and added functionality to require players to reset their passwords.
Increased Security Measures
As the result of a criminal cyber-attack on the company's network, SOE shut down its game services in order for the company to undertake an investigation and incorporate rigorous enhancements to the overall security of the network infrastructure. SOE worked with several outside respected security firms during the course of implementing significant security measures that strengthen safeguards against unauthorized activity and provide customers with greater protection of their personal information.
SOE made enhancements to overall data security as well, including updating and adding advanced security technologies, additional software monitoring, performing new penetration and vulnerability testing, and increased levels of encryption.
"Our main priority is the safety and security of our customers' personal information," said Kazuo Hirai, Executive Deputy President, Sony Corporation. "We are making consumer data protection a full-time, company-wide commitment, and have applied enhanced security technologies so that our customers can feel protected and confident about playing our games."
Hirai added, "We are committed to delivering secure and entertaining games for players of all ages and thank each of our players for their patience and support during this difficult time."
SOE will also be offering its customers a "Welcome Back" program that includes special game content and services to all registered Station Account holders. As part of this program, players will receive 30 days of additional game time plus one day for each day SOE's services were down. The details of this program are available at www.soe.com/securityupdate/welcomeback (http://www.soe.com/securityupdate/welcomeback).
For more information about the SOE network intrusion and restoration, please visit http://www.soe.com/securityupdate (http://www.soe.com/securityupdate)
QuoteThe Welcome Back rewards for EQ2:
•Double XP
•Double Guild XP
•Loot Bonanza
•The City Festivals and Moonlight Enchantments will be live
•The original Aether races return
Eligibility:
All players, each character
May 14, 2011 through May 22, 2011
Method of Collection:
Just login and play!
As of 7:30 pm EST, login servers and Sony websites seem to still be down. Perhaps it'll be up later tonight? I hope so.
AND......!!!!
As of 7:57 pm EST, I was able to get the launcher to connect. I was directed to a SOE page to change my password and review my account information.
YAY!!! :---
Well, this is encouraging news indeed. I'll be needing to attend to my account matters as well.
Question: What am I supposed to do?
I don't have an active account. But I was definitely active for 10 years off and on, through 4 of their games with multiple cards and accounts. I have received no e-mail about my security.
I might have been one of those that was part of the 2001 sweepstakes even.
Should I be concerned? Should I be getting an e-mail? Shouldn't I hear something?
Quote from: Phillion on May 15, 2011, 09:17:29 AM
Question: What am I supposed to do?
I don't have an active account. But I was definitely active for 10 years off and on, through 4 of their games with multiple cards and accounts. I have received no e-mail about my security.
I might have been one of those that was part of the 2001 sweepstakes even.
Should I be concerned? Should I be getting an e-mail? Shouldn't I hear something?
At a minimum, it wouldn't hurt to reset your password and review your stored account information, particularly if someone is clever enough to successfully reverse the hash on any leaked passwords and gain unauthorzied access to accounts.
Even though you don't have any active subscriptions, there shouldn't be anything stopping you from logging into your old Station account if you need to, assuming you remember your user name & password.
SOE Password Reset (https://account.station.sony.com/cam/resetRequired/resetPassword!input.action?theme=soe)
They actually extended all subscriptions, not only those active at time of the breach. My account expires in 45 days and my VG account is flagged on for that duration... makes me wonder :)
With that in mind, I guess this is potentially some good info to share with those who are interested:
QuotePC WELCOME BACK DETAILS
We want to ensure that your experience is as positive as possible as you re-enter our games. To show our gratitude for your patience and support, Sony Online Entertainment is offering a Welcome Back Program, the details of which are outlined below.
Firstly, as a Station Account holder in good standing, you will receive 45 days of game time (30 days plus 1 day for each day of the outage) added to your Station Account. This game time applies to any game you have currently or previously activated on your Station Account.
For those customers on an active paying plan, this time has been added to the end of your current billing cycle. For all other customers, your time begins upon your first login to each of the relevant games. Customers must login by 11:59 pm PST August 31, 2011 to claim the game time.
If you require the latest SOE game software, visit www.soe.com/getthegame (http://www.soe.com/getthegame).
In addition to game time, current Station Access subscribers (with accounts in good standing) will receive 500 Station Cash.
Lifetime subscribers/members (who are therefore not on a billing cycle) will receive in-game currency instead of game time:
•Clone Wars Adventures™ - 7,500 Galactic Credits
•Free Realms® - 20,000 Coin
•DC Universe™ Online - 10 Marks of Distinction
Additionally, many of our PC games are offering a variety of items and special events to welcome players back, depending on which game(s) you play or have ever played. The table below covers, by game, which items are available and who is eligible to receive them.
And maybe this too:
QuoteSony Online Entertainment Offering Free 'AllClear ID PLUS' Identity Theft Protection in the United States through Debix, Inc.More InfoMassachusetts Residents
Puerto Rico Residents
Restoration Announcement
Welcome Back Program
Recent Updates (as of May 14)
Identity Protection
Customer Service Notification
Press Release (May 3)
On Monday, May 2, Sony Online Entertainment (SOE) announced that it will provide complimentary enrollment in an identity theft protection program.
What follows are the details of this program for Station Account holders in the United States only. SOE and its sister Sony companies are actively investigating similar programs or other measures to support SOE customers in other countries or territories; more information on those programs or measures will be provided as they are implemented.
SOE has made arrangements with Debix, one of the industry's most reputable identity protection firms, to offer complimentary sign up to AllClear ID Plus. This service is available to Station Account holders in the United States for 12 months and commences upon sign up. Customers will have until June 28, 2011 to sign up.
AllClear ID Plus, powered by Debix includes:
•Cyber monitoring and surveillance of the Internet to detect exposure of an AllClear ID Plus customer's personal information, including monitoring of criminal web sites and data recovered by law enforcement. If his/her personal information is found, the customer will be alerted by phone and/or email and will be provided advice and support regarding protective steps to take. The customer will also receive monthly identity status reports. Debix works with an alliance of cyber-crime experts from the government, academia and industry to provide these services.
•Priority access to licensed private investigators and identity restoration specialists. If an AllClear ID Plus customer receives an alert, or otherwise suspects that he/she may be the victim of identity theft, the customer can speak directly, on a priority basis, with an on-staff licensed private investigator, who will conduct a comprehensive inquiry. In the case of an identity theft, the customer can work with an identity restoration specialist to restore his/her identity. The restoration specialist would contact creditors and others, and take necessary steps to restore the customer's identity.
•A $1 million identity theft insurance policy per user to provide additional protection in the event that an AllClear ID Plus customer becomes a victim of identity theft. This insurance would provide financial relief of up to $1 million for covered identity restoration costs, legal defense expenses, and lost wages that occur within 12 months after the stolen identity event.
To sign up, you will need to retrieve your AllClear ID Plus code (if you have not yet reset your Station Account password, you will be prompted to do so before you can obtain the code), then visit Debix to redeem your code and sign up. Please note that codes are not expected to be available until sometime during the week of May 16th.
I just logged in to Station and discovered that my DCUO, EQ, EQ2, and SWG subscriptions are all on "45 day non-recurring", so it looks like we can log into all of our games for the duration. Of course, it happens while I am on reduced game time ... ;-) Jasyn posted that last just as I was typing this. I can wait until I have free time again to use my time. Sweet!