New PSN attack compromises 60,000 accounts

Just when people had begun to forget about Sony’s security problems with PlayStation Network a new attack has compromised 60,000 accounts.

Posting on the official PlayStation Blog, Philip Reitinger, VP & chief information security officer, Sony Group, explained the situation: “We want to let you know that we have detected attempts on Sony Entertainment Network, PlayStation Network and Sony Online Entertainment (“Networks”) services to test a massive set of sign-in IDs and passwords against our network database. These attempts appear to include a large amount of data obtained from one or more compromised lists from other companies, sites or other sources. In this case, given that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs resulted in failed matching attempts, it is likely the data came from another source and not from our Networks. We have taken steps to mitigate the activity.”

Reitinger added: “Less than one tenth of one per cent (0.1%) of our PSN, SEN and SOE audience may have been affected. There were approximately 93,000 accounts globally (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000) where the attempts succeeded in verifying those accounts’ valid sign-in IDs and passwords, and we have temporarily locked these accounts.”

Of these 93,000 accounts, only a small fraction of these showed “additional activity” prior to being locked.

“We are currently reviewing those accounts for unauthorised access, and will provide more updates as we have them,” said Reitinger. “Please note, if you have a credit card associated with your account, your credit card number is not at risk. We will work with any users whom we confirm have had unauthorised purchases made to restore amounts in the PSN/SEN or SOE wallet.”

All accounts which had both a sign-in ID and password match are being forced to carry out a password reset. These users will be contacted by Sony. SOE accounts which were matched have been temporarily turned off – affected customers will be contacted by SOE.

Reitinger concluded: “We want to take this opportunity to remind our consumers about the increasingly common threat of fraudulent activity online, as well as the importance of having a strong password and having a username/password combination that is not associated with other online services or sites. We encourage you to choose unique, hard-to-guess passwords and always look for unusual activity in your account.”

Whether or not Sony is to blame for the latest attack will do little to help its relationship with customers – already pushed to breaking after attacks earlier this year forced Sony to shut down PSN.

It’s also interesting to see that Sony seems to take no responsibility for the attack and compromised user accounts, offering no apology.