Sony Playstation Network issues

[Jon]

As a eXceem member pointed out, Sony have posted a update on their blog about the issues surrounding the downtime of the Sony Playstation Network

According to their statement, they have taken down the network, after discovering that it has been hacked into, and personal information including user passwords & security questions & answers have been accessed. I am a bit lost for words how this could happen, and I would have thought Sony would be more than capable of ensuring this data is encrypted.

[Jon]

Originally Posted by http://blog.eu.playstation.com/

Valued PlayStation Network/Qriocity Customer,

We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network. In response to this intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our network infrastructure by re-building our system to provide you with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.

Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity passwords and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, to be on the safe side we are advising you that your credit card number (excluding security code) and expiration date may also have been obtained.

For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security, tax identification or similar number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

To protect against possible identity theft or other financial loss, we encourage you to remain vigilant to review your account statements and to monitor your credit or similar types of reports.

We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please check Official PlayStation website: Country Selector should you have any additional questions.

Sincerely,

Sony Network Entertainment and Sony Computer Entertainment Teams
Sony Network Entertainment Europe Limited (formerly known as PlayStation Network Europe Limited) is a subsidiary of Sony Computer Entertainment Europe Limited the data controller for PlayStation Network/Qriocity personal data.

The full blog post, it appears the site is under heavy traffic at the moment

[Cruelworld]

I only use PSN for Lovefilm so don't have my CC details on there, also my PSN password is different to anything else I use so I have no real problems but I can see how this had undermined confidence in the PS community.

Sony are going to have to do some real patching up after getting back online to repair customer relations.

[corky20]

An absolute disaster for Sony. Hopefully they're able to recover the information but even if they do this is going to be all over the news and will do real damage to the PS3... not to mention the PSN being down has killed sales for games such as Socom 4 which was released recently, could cause some developers to jump ship!

[Jon]

How will it affect users who are under 16 who's parents have their CC details on the account for their kids to play on the ps3, when the parents see this on the news headlines?

[Nero]

This is what PSN cards are for! I recomend changing your password when you sign in when it's back up.

[Dav7]

sad situation I'm tired of waiting.

They are trying to catch the hacker first and then restore PSN....

[Himpy]

There'll be lawsuits all over the place if credit card information has been compromised. Pretty much a disastrous situation at the moment, hopefully they can get it sorted out.

[justme]

This might become the Biggest online Crime ever

[joecooke]

This was posted yestaday dont no if u have seen it or not.

First off, we want to again thank you for your patience. We know that the PlayStation Network and Qriocity outage has been frustrating for you. We know you are upset, and so we are taking steps to make our services safer and more secure than ever before. We sincerely regret any inconvenience or concern this outage has caused, and rest assured that we’re going to get the services back online as quickly as we can.

We received a number of questions and comments yesterday and early today relating to the criminal intrusion into our network. We’d like to address some of the most common questions today.

We are also going to continue to post updates to this blog with any additional information and insight that we can over the next few days.

We are reading your comments. We are listening to your suggestions. Please keep them coming.

Thank you.

Q: Are you working with law enforcement on this matter?
A: Yes, we are currently working with law enforcement on this matter as well as a recognised technology security firm and local law enforcement to conduct a complete investigation. This criminal attack against our system and against our customers is a criminal act and we are proceeding aggressively to find those responsible.

Q: Was my personal data encrypted?
A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

Q: Was my credit card data taken?
A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code, sometimes called a CVC or CSC number) and expiration date may have been obtained.

Q: What steps should I take at this point to help protect my personal data?
A: For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your statements.

Q: What if I don’t know which credit card I’ve got attached to my PlayStation Network account?
A: If you’ve added funds to your PlayStation Network wallet in the past, you should have received a confirmation email from “DoNotReply@ac.playstation.net” at the email address associated with your account. This email would have been sent to you immediately after you added the funds, and will contain the first four digits and last four digits of your credit card number. You can also check your previous credit card statements to determine which card was attached to your PlayStation Network or Qriocity accounts.

Q: When or how can I change my PlayStation Network password?
A: We are working on a new system software update that will require all users to change their password once PlayStation Network is restored. We will provide more details about the new update shortly.

Q: Have all PlayStation Network and Qriocity users been notified of the situation?
A: In addition to alerting the media and posting information about it on this blog, we have also been sending emails directly to all 77 million registered accounts. It takes a bit of time to send that many emails, and not every email will still be active, but this process has been underway since yesterday. At this time, the majority of emails have been sent and we anticipate that all registered accounts will have received notifications by April 28th. Consumers may also visit uk.playstation.com/psnoutage and Qriocity - Home for notices regarding this issue. In addition, we have taken steps to disseminate information regarding this issue to media outlets so that consumers are informed.

Q: What steps is Sony taking to protect my personal data in the future?
A: We’ve taken several immediate steps to add protections for your personal data. First, we temporarily turned off PlayStation Network and Qriocity services and, second, we are enhancing security and strengthening our network infrastructure. Moving forward, we are initiating several measures that will significantly enhance all aspects of PlayStation Network’s security and your personal data, including moving our network infrastructure and data center to a new, more secure location, which is already underway. We will provide additional information on these measures shortly.

Q: Has Sony identified the party or parties responsible for the PlayStation Network hack and subsequent theft of personal information?
A: We are currently conducting a thorough investigation of the situation and are working closely with a recognised technology security firm in order to find those responsible for this criminal act, no matter where in the world they might be located.

Q: When will the PlayStation Network and Qriocity be back online?
A: Our employees have been working day and night to restore operations as quickly as possible, and we expect to have some services up and running within a week from yesterday. However, we want to be very clear that we will only restore operations when we are confident that the network is secure.

[vster2010]

there has been a lawsuit in america already. i think a lot people would place lawsuits on sony but its an expensive process.

[joecooke]

does anyone think that maybe a different company like xbox or wii would hack playstation like this so they get more people to buy there consols ? cus there will be alot of people who will get bored of waiting for them to come back online because its been like 5 days now and i know im getting bored of waiting but i got a xbox to play on aswell. But what about the people who just play playstaion they might say f**k it im gettin a xbox or something. Because this would help there main rivals alot. Sounds abit wierd but could happen :S

[Cruelworld]

Originally Posted by joecooke

does anyone think that maybe a different company like xbox or wii would hack playstation like this so they get more people to buy there consols ?

Wouldn't be worth it for them, imagine a company of that size getting caught sabotaging competitors ?
Would kill them off.

[joecooke]

ya got a point but they are having trouble finding who did it and i bet they are putting thousands into looking for them and still taking this long. Its got to be someone very clever

[buckers582]

Funny how gaming is so centred on multiplayer now.
This whole thing hasnt bothered me in the slightest
Red dead and Mortal Kombat are still quite playable

[vster2010]

my mate was like "i bought black ops because of the multiplayer". but now hes contenplaying i need to play single player. lol

[joecooke]

It will be working soon

This morning, a press conference took place in Tokyo, Japan and the following press release is now being distributed worldwide. We would also like to once again thank you for your patience.

On 1 May 2011, Sony Computer Entertainment (SCE) and Sony Network Entertainment International (SNEI, the company) announced they will shortly begin a phased restoration by region of PlayStation Network and Qriocity services, beginning with gaming, music and video services to be turned on.

The company also announced both a series of immediate steps to enhance security across the network and a new customer appreciation programme to thank its customers for their patience and loyalty.

Following a criminal cyber attack on the company's data centre located in San Diego, California, USA, SNEI quickly turned off PlayStation Network and Qriocity services, engaged multiple expert information security firms over the course of several days, and conducted an extensive audit of the system.

Since then, the company has implemented a variety of new security measures to provide greater protection of personal information. SNEI and its third party experts have conducted extensive tests to verify the security strength of PlayStation Network and Qriocity services.

With these measures in place, SCE and SNEI plan to start a phased roll-out by region of the services shortly. The initial phase of the roll-out will include, but is not limited to, the following:

Restoration of online gameplay across PlayStation 3 and PSP systems, including titles requiring online verification and downloaded games.
Access to Q Music Unlimited for PS3/PSP for existing subscribers.
Access to account management and password reset.
Access to download unexpired movie rentals on PS3, PSP and Media Go.
PlayStation Home.
Friends List.
Chat functionality.
Working closely with several outside security firms, the company has implemented significant security measures to further detect unauthorized activity and provide consumers with greater protection of their personal information.

The company is also creating the position of Chief Information Security Officer, directly reporting to Shinji Hasejima, Chief Information Officer of Sony Corporation, to add a new position of expertise in and accountability for customer data protection, and to supplement existing information security personnel.

The new security measures implemented include, but are not limited to, the following:

Added automated software monitoring and configuration management to help defend against new attacks.
Enhanced levels of data protection and encryption.
Enhanced ability to detect software intrusions within the network, unauthorized access and unusual activity patterns.
Implementation of additional firewalls.
The company also expedited an already planned move of the system to a new data centre in a different location that has been under construction and development for several months.

In addition, PS3 will have a forced system software update that will require all registered PlayStation Network users to change their account passwords before being able to sign into the service. As an added layer of security, that password can only be changed on the same PS3 in which that account was activated, or through validated email confirmation, a critical step to help further protect customer data.

The company is conducting a thorough and ongoing investigation and working with law enforcement to track down and prosecute those responsible for the illegal intrusion.

"This criminal act against our network had a significant impact not only on our consumers, but our entire industry," said Kazuo Hirai, Executive Deputy President, Sony Corporation. "These illegal attacks obviously highlight the widespread problem with cyber security. We take the security of our consumers' information very seriously and are committed to helping our consumers protect their personal data. In addition, the organization has worked around the clock to bring these services back online, and are doing so only after we had verified increased levels of security across our networks. Our global audience of PlayStation Network and Qriocity consumers was disrupted. We have learned lessons along the way about the valued relationship with our consumers, and to that end, we will be launching a customer appreciation programme for registered consumers as a way of expressing our gratitude for their loyalty during this network downtime, as we work even harder to restore and regain their trust in us and our services."

Complimentary Offering and "Welcome Back" Appreciation Programme

While there is no evidence at this time that credit card data was taken, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programmes. The implementation will be at a local level and further details will be made available shortly in each region.

The company will also roll out the PlayStation Network and Qriocity "Welcome Back" programme, to be offered worldwide, which will be tailored to specific markets to provide our consumers with a selection of service options and premium content as an expression of the company's appreciation for their patience, support and continued loyalty.

Central components of the "Welcome Back" programme will include:

Each territory will be offering selected PlayStation entertainment content for free download. Specific details of this content will be announced in each region soon.
All existing PlayStation Network customers will be provided with 30 days free membership in the PlayStation Plus premium service. Current members of PlayStation Plus will receive 30 days free service.
Q Music Unlimited subscribers (in countries where the service is available) will receive 30 days free service.
Additional "Welcome Back" entertainment and service offerings will be rolled out over the coming weeks as the company returns the PlayStation Network and Qriocity services to the quality standard users have grown to enjoy and strive to exceed those exceptions.

SNEI will continue to reinforce and verify security for transactions before resuming the PlayStation Store and other Qriocity operations, scheduled for this month.

For more information about the PlayStation Network and Qriocity services intrusion and restoration, keep an eye on PlayStation.Blog at blog.eu.playstation.com, twitter.com/PlayStationEU and eu.playstation.com for the latest updates.

[Nero]

Hopefully it is up tonight

[xploit]

Originally Posted by Nero

Hopefully it is up tonight

my mrs said that too

[dbatch]

Originally Posted by xploit

my mrs said that too

wish i had a missus like yours!