Of course, the PlayStation Network and Qriocity services have been down since on or about April 19th.  Sony has confirmed that its servers were breached and personal information was stolen by an unknown group.

Now, it looks like user information from Sony’s Online Entertainment Division has been compromised as well.  From SOE:

This information, which was discovered by engineers and security consultants reviewing SOE systems, showed that personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007.  The information from the outdated database that may have been stolen includes approximately 12,700 non-U.S. credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain.

Sony Online Entertainment is a gaming division of Sony that produces huge online multiplayer games, among other things.  Some if its most well known games are the MMORPG EverQuest, Star Wars Galaxies and Free Realms. 

Sony discovered this during their ongoing investigation of the PSN and Qriocity attacks.  Originally, they thought that SOE users accounts had not been touched during the initial hack, but just now concluded that they had in fact been accessed on April 16th and 17th.

Sony says that this is not a new cyber-attack.  This is part of the original “external intrusion” that prompted the shutdown of the PSN.  A Sony rep told Joystiq :

“While the two systems are distinct and operated separately, given that they are both under the SONY umbrella, there is some degree of architecture that overlaps. The intrusions were similar in nature. This is NOT a second attack; new information has been discovered as part of our ongoing investigation of the external intrusion in April.”

The extent of the information stolen for U.S. customers is name, address, email, birthday, password and phone number.  For non-U.S. players, it’s a little more dicey.  As stated above, credit card info was indeed stolen as well as direct deposit information which Sony details to mean bank account numbers and account names.

Like Sony has stated when addressing the PSN outage, they say there is no evidence that their main credit card database was compromised – so U.S. players have no confirmation whether their financial info has been stolen or not.

Like the PSN after the hack, Sony has taken down its SOE services while they investigate.  Yesterday, they announced that the PSN will return many of its services some time this week.  Sony will also be offering a “welcome back” rewards program as an apology to its users for the outage.

According to the YouTube blog…

We are pleased to report that Viacom, MTV and other litigants have backed off their original demand for all users’ viewing histories and we will not be providing that information.

In addition, Viacom and the plaintiffs had originally demanded access to users’ private videos, our search technology, and our video identification technology. Our lawyers strongly opposed each of those demands and the court sided with us.

So, should we celebrate the protection of our private data? Not so fast! Viacom’s not getting your data because it realized the swarm of negative publicity that would follow, not because a judge ruled it couldn’t have it.

The precedent has been set and, until challenged, will give grounds for others to request all kinds of personal data from the Google et al.

Comments

The EFF reports the order requires Google to hand over YouTube’s Logging database. What’s in YouTube’s logging database?

…for each instance a video is watched, the unique “login ID” of the user who watched it, the time when the user started to watch the video, the internet protocol address other devices connected to the internet use to identify the user’s computer (“IP address”), and the identifier for the video.

I’ve bolded the entire text, because this is serious Pilgrims! If Google complies, potentially millions of YouTube users will have their private details handed to Viacom!

The EFF states that the judge has likely broken the law, with his ruling–your video viewing preferences are supposedly protected by the Video Privacy Protection Act.

Over at TechCrunch, Michael Arrington speculates that Viacom only requested this information, so that it may determine who watched copyrighted content, and sue them too.

I’ll close, echoing Arrington’s sentiment:

I say this with the utmost respect, but Judge Stanton is a moron. And Google simply cannot hand this data over without facing a class action lawsuit of staggering proportions.

The ball’s in your court now Google. Throw us users under the bus, and we might just do the same to you!

Comments