PlayStation data breach in 'top 5 ever': researcher
More than 75 million accounts worldwide, including more than one million in Canada, are registered with the network that suffered a massive data breach this week, Sony confirmed Wednesday.Names, birthdates and some credit card data may have been stolen from users of Sony's PlayStation Network in what may be one of the biggest data breaches ever.
More than 75 million accounts worldwide, including more than one million in Canada, are registered with the network that suffered a massive data breach this week, Sony confirmed Wednesday.
The massive breach is one of the "top five ever," said Alan Paller, director of research for the SANS Institute, a cybersecurity training and research institution based in Bethseda, Md.
More than 70 per cent of PlayStation 3 video game consoles are connected to the PlayStation Network, which allows users to play online games, surf the web, chat with friends and download games and other content from the PlayStation store.
The breach also affects users of Sony's Qriocity service, which streams movies on demand to compatible Sony devices such as HDTVs and Blu-ray players for a monthly fee.
Sony announced the data breach on its PlayStation blog Tuesday afternoon, six days after it shut down both services after learning of an "external intrusion" on April 19.
Tuesday's blog post detailed the personal information that it believes "an unauthorized person has obtained" from users:
- Name, address (city, state, postal code), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID.
- Possibly other profile data, including purchase history and billing address (city, state, postal code), and the subscriber's PlayStation Network/Qriocity password security answers. The same data with respect to a dependent may also have been obtained. If an account holder provided credit card data, the credit card number (excluding security code) and expiration date may also have been obtained.
The company said in a clarifying blog late Tuesday that it did not inform users of the breach earlier because it took until Monday "to understand the scope of the breach" following several days of forensic analysis by outside experts.
Paller said the breach is particularly dangerous to users because of the valuable information contained in the billing data about users' behaviour and preferences, which can be used to craft personalized scams.
"It's extremely dangerous because it's a perfect … targeting mechanism for targeted phishing."
The United Kingdom's Information Commissioner, who enforces the country's Data Protection Act, has told the London-based Telegraph newspaper that he is contacting Sony to learn more about the incident.
Categories:
Researcher
0 comments:
Post a Comment