April 21 PSN and Qriocity outage

[tux]

And, the class-actions have started:

http://news.cnet.com/8301-31021_3-20057921-260.html

The complaint accuses Sony of not taking ""reasonable care to protect, encrypt, and secure the private and sensitive data of its users" and not allowing customers "to make an informed decision as to whether to change credit card numbers, close the exposed accounts, check their credit reports, or take other mitigating actions."

[hugh]

Frankly I hope that Sony gets sued for millions. Not because I have a hate on for Sony but simply to put big companies on notice that they have a responsibility to protect sensitive customer information.


If Sony gets successfully sued for $500 million then you can be darn sure that other companies will do a lot more to protect their customers data.

yes it will cost consumers a bit more but I think its worth it.

[eimaj]

I hope a class action suit comes out of this so we can all sign up and get some restitution for Sony's lack of transparency (and lateness on telling us of the severity) on a critical issue about its customers personal information. I have already cancelled my credit card as a precaution (of which I am already inconvenienced over until my new one arrives in a week), but I would loathe to see any mail show up at my door or get phone calls about things I never applied for due to someone having my personal information and using it to their gain. Hopefully that never happens.

[studum]

I have just now received my email.

I'm not impressed. Having this happen is bad enough, not being notified of it in a timely manner is worse.

[PokerChip]

Just got the email as well.

I will be calling my credit card company also. Now I'll have to call everybody who gets paid automatically (again) to let them know about the new number.

We need credit cards with little LED numbers on them that revolve and generate single use numbers, like revolving garage door codes.

At any rate, the silver lining is that based on the dates mentioned in their communications (April 17-19), if something bad had to happen with your cc, it would have happened already. Whomever stole the info would have acted on it rather quickly as they know everybody in on high alert now.

[Dioneo]

At the least I'm hoping the suit will force Sony to allow PSN accounts to be closed and permanently deleted.

[hugh]

Some off topic Posts removed. Please lets keep the discussion on the events at Sony.

[audacity]

Originally Posted by hugh

Frankly I hope that Sony gets sued for millions. Not because I have a hate on for Sony but simply to put big companies on notice that they have a responsibility to protect sensitive customer information.

First I should confess I've had a bit of a hate on for Sony ever since they pulled that root kit debacle on all the CDs they published which installed a root kit on your OS. I remember having to clean that up on a couple of my friends computers.

While I think it is bad that Sony's systems got hacked, Sony's fault is merely incompetence, not malice like the Sony root kit case. It is monumentally difficult to create a highly secured system, especially when there are privileged users on the said system who are human. Humans are corruptible or can be manipulated into giving out information much too easily. There are a number of security studies that have been done on this topic, and the results are scary.

I think Sony should be responsible for the remuneration of it's affected customers, but I don't think awarding punitive damages is justified as long as Sony can prove that they went to considerable effort to secure their systems, and their systems were compromised in spite of those efforts.

I dislike Sony, but I dislike unfairness even more. Sony is about to face the anger of a mob that doesn't realize how difficult it is to lock computers down and I start to feel sorry for them.

But then I remember the root kit thing.

[hugh]

One could say the BP disaster was simply incompetence too.

Over the years, large settlement over "incompetence" in many industries have magically led to much improved standards and much fewer problems.

Is any system perfect? Probably not but as long as companies pay lip service to security incompetence will be commonplace.

[audacity]

The BP disaster was incompetence, but I don't think the $20B settlement money that is being given out is adding a "punitive value" to each settlement. Instead each settlement is being awarded fairly based on the loss of income or some other demonstrable loss. My source of data for this is from listening to CBC radio in a morning last week where they had the guy who was responsible for assessing and awarding damage claims.

I completely agree that Sony should pay for the costs that users must incur due to identity theft resulting from this, or the expense of getting credit checks, etc. I just don't think everyone should get an additional $5000 "just because Sony leaked their info".

[dufferdan]

In this day and age, for an electronics company with the cultivated reputation for producing highly technical and sophisticated electronics and software products, and a company with a history of embedding files into clients computers for tracking and other purposes, it could be safely assumed by customers that SOny would have state of the art hardware and software solutions for protecting client data. If it is found that they promoted online sales of any kind without such protections, they will get spanked, and not just a little. This could run into the billions of dollars, and potentially destroy the companys' reputation.

I just checked Sony's Canadian website. I just heard about this today after checking in here. Sony appears to be taking action to mitigate potential damage for their US customers, but I see nothing for us Canadians.

I think I funded my son's Sony account with $30 about four years ago. Am I at risk? I have no idea what password I used or anything. One time and I incorrectly assumed it would be wiped after the fact.

This is not incompetence. It will be viewed by the courts as criminal negligence.

Disclaimer: I am not a lawyer, nor did I stay at a Holiday Inn Express last night>

Oh, edit to add: You KNOW the credit card companies are gonna be all over this as well.

[TorontoColin]

I just got my email. Nothing about them notifying Canadian credit agencies. Glad I don't have a credit card tied to my account.

[DSgamby]

#1 QA
http://blog.us.playstation.com/2011/...city-services/

[Eluder]

Got the email too, but as others have said, nothing tailored to us Canadians.

I'm most concerned about the identity theft at this point, CC is already cancelled and being replaced.

[Gord Lacey]

Does anyone else think these two comments by Sony are a bit odd?

All of the data was protected, and access was restricted both physically and through the perimeter and security of the network.

and

Moving forward, we are initiating several measures that will significantly enhance all aspects of PlayStation Network’s security and your personal data, including moving our network infrastructure and data center to a new, more secure location, which is already underway.

Those two quotes make it sound as though someone physically gained access to a network, doesn't it?