An Important Message From Sony's Chief Information Security Officer
We want to let you know that we have detected attempts on Sony Entertainment Network, PlayStation Network and Sony Online Entertainment ("Networks") services to test a massive set of sign-in IDs and passwords against our network database.
Context & Ripple Effects
This is the second act of a brutal year for Sony's network security. In April, an external attack brought down PlayStation Network for weeks, followed by claims that hackers held PlayStation users' card data, a May breach at Sony Online Entertainment, and CEO Howard Stringer conceding in May that no network is '100% secure'. Hackers even handed Sony an 'epic fail' award at August's Pwnie Awards.
What distinguishes this disclosure is its shape: rather than a fresh intrusion, Sony's CISO says attackers tested massive sets of sign-in IDs and passwords against the network databases — credentials likely harvested from breaches elsewhere on the web. Electronista puts the cracked accounts at roughly 93,000 across PlayStation Network and Sony Online Entertainment.
First-order effects
- Roughly 93,000 account holders on PlayStation Network and Sony Online Entertainment face locked accounts and forced password resets as Sony purges the matched credentials from its databases.
- Sony must again run incident response on its Networks five months after the April outage, with the CISO — not PR — fronting the message, signaling the company is treating this as a security-operations disclosure rather than a marketing problem.
Second-order effects
- Because the attack reuses IDs and passwords stolen from other sites, the blast radius extends beyond Sony: any user who recycled credentials now has to audit accounts across unrelated services, pushing password-manager adoption and unique-password norms.
- Regulators and payment partners who scrutinized Sony after the April breach and card-data claims get a new data point on whether the company's post-outage hardening actually works, raising the cost of any further lapse.
Third-order effects
- The episode marks credential stuffing becoming a standing attack class against large consumer platforms: defense shifts from keeping intruders out of the perimeter to continuously matching sign-in traffic against known-breached credential lists and invalidating matches proactively.
- If reused passwords remain the weak link, platform operators will keep absorbing the cleanup costs of other companies' breaches — an argument for industry-wide breach-notification standards and eventually killing raw passwords as the primary authentication factor.
The trend: Large consumer networks are moving from perimeter defense toward assuming user credentials are already compromised, with continuous credential-matching and forced resets becoming routine security hygiene.