Sony fined £250,000 for 2011 PlayStation hack

 

Gallery

By Stewart Mitchell

Posted on 24 Jan 2013 at 10:41

Sony has been hit with a £250,000 fine for a data breach following hacks against its PlayStation Network.

The Information Commissioner's Office (ICO) fine - its largest yet against a private firm - comes nearly two years after Sony's PlayStation Network Platform was breached in April 2011, when hackers lifted the details of millions of account holders, including their names, addresses, email addresses, dates of birth and account passwords.

Payment card details were also compromised, making a monetary penalty likely and, according to the ICO, the penalty reflected Sony's inability to protect customer data adequately.

"If you are responsible for so many payment card details and log-in details then keeping that personal data secure has to be your priority," said deputy commissioner David Smith.

Sony is a company that trades on its technical expertise, and had access to both the technical knowledge and the resources to keep this information safe

"In this case that just didn't happen, and when the database was targeted – albeit in a determined criminal attack – the security measures in place were simply not good enough."

Smith was critical of Sony's defences, which could have thwarted the attacks had they been up to date, and implied that a technology company should be better at protecting customer information.

"There’s no disguising that this is a business that should have known better," Smith said in a statement. "It is a company that trades on its technical expertise, and there’s no doubt in my mind that it had access to both the technical knowledge and the resources to keep this information safe."

The ruling also stated that Sony should have had better protection in place because in the weeks running up to the hack it had been the subject of a sustained campaign of DDoS attacks.

Smith said the high-profile nature of attacks had increased consumer awareness and made people more cautious about disclosing private information.

Sony to appeal

Sony said it "strongly disagrees" with the ruling and is planning an appeal.

"Criminal attacks on electronic networks are a real and growing aspect of 21st century life and Sony continually works to strengthen our systems, building in multiple layers of defence and working to make our networks safe, secure and resilient," a Sony spokesperson said.

The ICO said the case took two years to resolve because of the time it took to go through Sony's response to its queries.