Sony has announced the bad news: hackers have your personal data, and they may have your credit card information as well. Now it's time for the questions, such as how much this breach and the bad PR attached to it will hurt Sony, and how long the company knew the data was in the hands of the hackers before sharing that information with customers. While it doesn't look like Sony will be liable in any legal sense for holding back information, this black eye won't soon go away.
How much danger are we in?
I called Beth Givens, the director of the Privacy Rights Clearinghouse, a "nonprofit education and advocacy organization dedicated to protecting the privacy of American consumers," to get her take on the matter. "The key piece of data for identity theft is the social security number, and that has not been compromised," she told Ars. The real danger is that, with the information that we know has been taken, hackers with malicious intent could use social engineering to pose as Sony and gain the trust of consumers to gather more information. To its credit, Sony did warn of that danger in its initial announcement.
The question is whether Sony broke any laws if it was aware of the data being taken and didn't immediately warn consumers. Givens argues that the law is more complicated than that. "The data breach laws for the most part allow for some wiggle room in terms of notice. Six days, in comparison to other breaches, is not unheard of." Still, it's a troubling amount of time. "Once they were certain of the breach, and were certain of the types of data compromised, they should have told the affected individuals immediately."
California's disclosure law, for instance, doesn't come into play as long the data is encrypted, or a law enforcement states that disclosing the breach could harm an investigation. That's an easy loophole, however. "The law enforcement provision in these laws has been used to unnecessarily delay notice in many, many breaches," Givens explained.
While Givens was quick to point out that Sony may not have broken any laws, she's not willing to praise the company. "When you look at past business crises, and there are business school case studies of these things, you get high praise if you come out early and clearly with information about the breach," she said. This is something Sony did not do. "Not just a little bit of information, but a lot of information so individuals know what has happened and what they need to do."
This is all assuming that credit card information has not been stolen. If it turns out that credit card data has been taken as well, the damages could become very large, very quickly. That has gotten the attention of at least one man in government.
Connecticut Senator Richard Blumenthal is upset about the breach, and has written a letter to SCEA President Jack Tretton, citing his concern over the loss of personal data.
"Compounding this concern is the troubling lack of notification from Sony about the nature of the data breach. Although the breach occurred nearly a week ago, Sony has not notified customers of the intrusion, or provided information that is vital to allowing individuals to protect themselves from identity theft, such as informing users whether their personal or financial information may have been compromised," he wrote. "Nor has Sony specified how it intends to protect these consumers."
He called for Sony to act in a decisive manner, instead of the current foot-dragging standard. "Additionally, PlayStation Network users should be provided with financial data security services, including free access to credit reporting services, for two years, the costs of which should be borne by Sony," he said. "Affected individuals should also be provided with sufficient insurance to protect them from the possible financial consequences of identity theft."
This is a temporary problem
"Sony is doing the best that they can in a really tough situation. Security breaches happen, and they are horribly inconvenient for customers, but at least in the US, no PSN customer is going to be liable to pay bills for credit card info that was fraudulently obtained," Michael Pachter, the managing director of Equity Research at Wedbush Securities, told Ars. "Thus, although this hurts Sony's image with its customers, nobody really suffered anything more than the loss of enjoyment for a couple of weeks, and the hassle of tracking down whether somebody is fraudulently using credit info."
The fact that the target of the attack was a gaming service, and not a bank, is also comforting. "In my view, a serious hacker with evil intent would be better off hacking into a financial institution rather than a gaming network," he said. "My guess is that this is somebody who hacked in for fun, and who has no intention of doing anything illicit with the information, so I think it's really just an unfortunate inconvenience, and not a serious security threat."
The takeaway is that while Sony is going to suffer some loss of trust, they will be back in everyone's good graces in a matter of time. "I expect that Sony will give everyone some free stuff—a Fat Princess download?—and they will definitely refund something to the PlayStation Plus customers," Pachter said. "Over the long run, we'll all forget about this, unless it happens again."
Sony doesn't get communication, and this will hurt the company
The toothless disclosure laws won't hurt Sony, but the fact that the company shared so little information in the six days leading up to this announcement is damning. Gamers were left with no way to buy new games, which hurt developers, and even worse they couldn't play any of the games they already owned with their friends. When such a large part of the system is taken away from your customers, they deserve more than a few weak updates saying that there is nothing to report, while thanking them for their patience.
The problem is that gamers weren't being patient—they were pissed off. Now it looks like Sony hid the extent of the breach from consumers, and that's not helping matters much. The company has exhibited a tin ear throughout the entirety of this process, and the bland apologies in the latest update, in contrast to the dire news in the post, made it sound like Sony didn't understand the damage it has done to itself with consumers.
What's unclear is who may have hacked the service. Anonymous has been quick to claim they aren't responsible, but Sony has done a lot to make sure it has powerful enemies in the darker corners of the Internet. In some circles, damaging a company this badly would be considered a badge of honor, no matter how many other people were hurt in the process.
While researching this story, I called my bank and asked if they had heard anything about the breach. "No, but I have a PlayStation 3 at home and I know Sony was going to make an announcement today or tomorrow—what's going on?" the man on the phone said. I explained who I was, and read him a few sections from Sony's announcement. There was silence on the line for a moment. "Oh crap," he said, finally, before getting up and getting his manager.
reader comments
234