An attack on Sony’s PSN has not only angered Playstation owners at the thought of their credit card information being comprimised, but also Connecticut Senator Richard Blumenthal who sent a letter to Sony’s CEO, Jack Tretton demanding to know why Sony failed to report to users on April 20 when the attack happened instead of waiting for a week to pass by before users were notified of the data privacy breach.

“April 26, 2011

Mr. Jack Tretton

President and CEO

Sony Computer Entertainment America

919 East Hillsdale Boulevard

Foster City, CA USA 94404

Dear Mr. Tretton:

I am writing regarding a recent data breach of Sony’s PlayStation Network service. I am troubled by the failure of Sony to immediately notify affected customers of the breach and to extend adequate financial data security protections.

It has been reported that on April 20, 2011, Sony’s PlayStation Network suffered an “external intrusion” and was subsequently disabled. News reports estimate that 50 million to 75 million consumers – many of them children – access the PlayStation Network for video and entertainment. I understand that the PlayStation Network allows users to store credit card information online to facilitate the purchasing of content such as games and movies through the PlayStation Network. A breach of such a widely used service immediately raises concerns of data privacy, identity theft, and other misuse of sensitive personal and financial data, such as names, email addresses, and credit and debit card information.

When a data breach occurs, it is essential that customers be immediately notified about whether and to what extent their personal and financial information has been compromised. Additionally, PlayStation Network users should be provided with financial data security services, including free access to credit reporting services, for two years, the costs of which should be borne by Sony. Affected individuals should also be provided with sufficient insurance to protect them from the possible financial consequences of identity theft.

I am concerned that PlayStation Network users’ personal and financial information may have been inappropriately accessed by a third party. Compounding this concern is the troubling lack of notification from Sony about the nature of the data breach. Although the breach occurred nearly a week ago, Sony has not notified customers of the intrusion, or provided information that is vital to allowing individuals to protect themselves from identity theft, such as informing users whether their personal or financial information may have been compromised. Nor has Sony specified how it intends to protect these consumers.

PlayStation Network users deserve more complete information on the data breach, as well as the assurance that their personal and financial information will be securely maintained. I appreciate your prompt response on this important issue.

Sincerely,

/s/

Richard Blumenthal

United States Senate”

Sony has responded publicly to Playstation users by stating on the Playstation Network Blog:

“Thank you for your patience while we work to resolve the current outage of PlayStation Network & Qriocity services. We are currently working to send a similar message to the one below via email to all of our registered account holders regarding a compromise of personal information as a result of an illegal intrusion on our systems. These malicious actions have also had an impact on your ability to enjoy the services provided by PlayStation Network and Qriocity including online gaming and online access to music, movies, sports and TV shows. We have a clear path to have PlayStation Network and Qriocity systems back online, and expect to restore some services within a week.”

via Joystiq

 

Tweet This Post

View the full article

Within another week? Two weeks of no service whatsoever.

Yikes..... I'm also glad that I have a nonworking and expired CC listed on my PSN account. *shrugs* Small consolation I know, but it is what it is.

I bet it was letters and emails like that, that finally got them to come 'clean' and be open.

When their network is back up and running, I'll probably be doing the same. I think I'll be cancelled my PSN and at the very least have a cool looking Blu-ray player. Sure the same thing could happen to any network or network accessible device, but it didn't, it happened to a very incompetent company that should have addressed the problem as soon as it arose, not wait an entire week to tell it's customers their information had been compromised. It's complete bullshit and about as unprofessional as you can get when dealing with a crisis. This is brand damaging and any consumer with a Playstation console should really be reassessing their entertainment investment.

Sony, you've failed me for the last time and I'm afraid we'll have to break it off. Microsoft and I are going steady again.

I think this is Sony's version of the "3 red lights" issue.

I think this is Sony's version of the "3 red lights" issue.

Yup. I'll take a console that occasionally breaks over one that STEALS MY BLAMMING IDENTITY!!! LoL

any consumer with a Playstation console should really be reassessing their entertainment investment.

You should see the apologist fanboys working overtime right now. How blind and stupid do you need to be, before you finally realize you win nothing from winning a console war. This isn't even about a console war. This is private information, that can be sold to others. Then there's the credit card/debit fiasco. That alone should get these fanboys to listen up and stop playing the shill.

Does anybody remember the ps2's rampant dics read error problem? Of course not, because everyone was force fed the Red Ring of Death nonsense. Microsoft at the very least took full responsibility for it's faulty hardware and nullified the problem by taking a huge financial hit to alleviate the issue. This isn't the first time Sony has dropped the ball, but this is a far bigger problem than any consoles hardware failure, this is the potential theft of someone identity. WTF Sony!

I smell a class action lawsuit in the near future...

How right you are SegaCKY....

Class Action Lawsuit Filed

Think this will continue to hurt them into the next generation of consoles?

I don't think it's going to hurt them on a large enough to scale to cause major problems, after all if Microsoft can recover from the 3 red light issue, I'm sure Sony can recover from this. However I believe they lost trust and faith from some if not most of their users and it might take a long time to get that back especially whenever they announce a new console. If I was a Sony user that would be my first question regarding a new console.....how secure is it going to be this time?

I feel this is a huge invasion on Sony's part. Granted, their service is "free", but it shouldn't include being lazy with our personal info. This is exactly why I hate how much info we are required to provide about ourselves. Everything is online. Even when I went to the doctor's office with Coy last night they wanted her to sign some consent form to include all her medical history on some digital server which can be accessed all across New York State. I'm leary about stuff like that.

Even when I went to the doctor's office with Coy last night they wanted her to sign some consent form to include all her medical history on some digital server which can be accessed all across New York State. I'm leary about stuff like that.

As you should be, that's your livelihood. Every company should care deeply about its customers security, there's comfort in safety and its the best way to garner support for its product. I just wish Sony's concern was more on addressing it's problems in a timely manner and alleviating this issue, than covering their own *** by passing it off as the fault of the hackers alone.

Amen, Sega. From one report, we hear about their devnet. A service which didn't even require a valid credit card number. You could purchase content from PSN, with any made up numbers. That report mentioned that as soon as it was found out, they took all older versions of that software offline, and alerted its users to only access it with the latest version. That's HUGE, if true.

That would mean one of two things. Their software authors didn't check their coding thoroughly, or they just decided to trust that anyone using the devnet would be perfectly honest.

That sort of oversight is major. Again, if it's all true. I'm not sure if it's been totally confirmed yet or not.

There's simply no excuses for them here. They screwed up in a major way. Sony is a multinational corporation that consumers should be able to trust with sensitive information. A breach of security is one thing. This was a total failure of Sony's system.

That lawsuit will win and I'm anxious to see what the final settlement is.

I hear people standing up for them, and it makes me shake my head. They say they'd never place their CC info on there (PSN or XBL). That's what pre-paid cards are for. I then ask them how they'd feel if Amazon had done this. Almost all of us have CC or debit card info on there. Care to guess how they replied to that? lol

This is why you pay for an online gaming service, so **** like this doesn't happen.

I wouldn't be nearly as pissed if it was just my name and address. Sure, it sucks, but damn if people don't get that information anyway without thievery. Along with phone numbers. However, what really pisses me off is they have this sensitive information with a login and password and they didn't HASH the GD PASSWORD! I mean, WTF? Fucking wordpress hashes passwords and they don't?!