Sony hires Mandiant after cyber attack, FBI starts probe
(Reuters) - Sony Pictures Entertainment has hired FireEye Inc's Mandiant forensics unit to clean up a massive cyber attack that knocked out the studio's computer network nearly a week ago, three people with knowledge of the matter said on Sunday.
Context & Ripple Effects
The Mandiant hire comes after days of escalating damage: the attackers had already begun dumping lists of stolen corporate files online, and the network outage left employees working around crippled systems. Bringing in FireEye's forensics arm signals Sony now treats this as a full-scale breach remediation, not an IT incident.
The FBI opening a parallel probe matters because the case would soon become a national-security matter — weeks later the bureau publicly attributed the attack to the North Korean government. Internal accounts later showed Sony was slow to grasp the breach's gravity, which is exactly the gap a Mandiant engagement is meant to close.
First-order effects
- Sony Pictures gets an outside incident-response team to evict attackers, assess what was exfiltrated, and restore its knocked-out network; the FBI gains a formal investigative channel into the intrusion.
- FireEye/Mandiant lands one of the highest-profile incident-response engagements in corporate history, immediately raising its visibility in boardrooms weighing their own breach readiness.
Second-order effects
- Every major studio and large enterprise now faces pressure to pre-negotiate forensic retainers and rehearse breach playbooks, since Sony's week-long paralysis became the cautionary benchmark.
- Rival security firms get a marketing tailwind as boards ask whether they have a 'Mandiant on call'; demand shifts toward retainers and rapid-response contracts rather than ad-hoc engagements after the fact.
Third-order effects
- If state-sponsored attacks on private companies become routine, breach response consolidates into a small set of elite forensics firms that function as quasi-utilities, and government agencies like the FBI become standing partners in what were once purely corporate incidents.
- The episode pushes regulators and insurers toward treating destructive intrusions — not just data theft — as a board-level risk category, reshaping cyber insurance underwriting and disclosure expectations.
The trend: State-linked cyber attacks on high-profile corporate targets are turning incident-response firms and federal investigators into permanent fixtures of crisis management, normalizing external forensics as standard governance.