The UK's ICO, the data protection watchdog, has fined Sony Computer Entertainment for breaching data protection laws. Hackers had broken into Sony's Playstation Network in April 2011 and gained access to the personal data of millions of customers of the gaming service, including credit card details. The hack was not limited to members in the UK, but to 77 million in various countries.
The ICO has found Sony liable for a breach that compromised the data of British citizens. Following an investigation by the British agency, it concluded that the breach could have been avoided if Sony had kept its software up to date. It also found that security measures were inadequate.
The head of the ICO, David Smith, said characteristically that, "when you are responsible for so many payment cards and so many login details, their security must be your priority. In this case, that did not happen and in this - of course decisive - criminal attack the security measures were not sufficient. Sony should have known better...", said Mr. Smith, among other things (you can watch the relevant video).
In April 2011, billing information, including names, dates of birth, addresses and email addresses, was compromised for “some Playstation Network users” who numbered 77 million in 59 countries at the time. Purchase history and billing addresses may also have been stolen, although Sony has said that the three-digit security number on the back of credit cards was not stolen.
tech.in.gr had then contacted Sony in Greece, and we recorded that the PlayStation Network members from Greece were 210,000, 20,000 of whom had registered credit card details (which may have been stolen).
Later, in May 2011, sonymusic.gr was hacked, possibly leaving the details of 8,385 users exposed. The Greek site of Sony BMG Greece at the address sonymusic.gr was targeted by hackers who were then carrying out successive attacks on Sony: the hacker with the code name bd4_vipera allegedly defaced the home page of the site, while all the details of the site's registered users (regarding more than eight thousand members) were exposed on the Internet. In fact, part of the stolen database with visible usernames and full names was published online, albeit briefly.
