PCPD -

Date: 28 April 2011

Privacy Commissioner probes into data breach by Sony PlayStation® Network

1.    The Privacy Commissioner for Personal Data Mr. Allan Chiang (“the Commissioner”) announced that he had commenced a compliance check today (28 April) to probe into the data breach by Sony involving, on a global basis, 77 million customer accounts of its PlayStation®Network (“PSN”).

2.    To ascertain the situation as a matter of urgency, the Commissioner met today Mr. Katsuhiko Murase, Deputy Managing Director of Sony Computer Entertainment Hong Kong Limited (“SCEH”).

3.    Mr. Murase expressed regret for the incident and provided the following information:-
-    Between 17 and 19 April 2011, certain PSN user account information was compromised as a result of an illegal and unauthorized intrusion into its network.
-    The account information compromised includes name, address, country, email address, birthdate, PSN password and login, and PSN online ID.
-    There is no evidence that credit card data (secured by encryption) was taken but SCEH cannot rule out this possibility.
-    The PSN has since 20 April 2011 been shut down.
-    The incident involved about 400,000 Hong Kong accounts (one user can hold more than one account).
-    SCEH will complete notifying individually all affected Hong Kong account holders by 30 April 2011 at the latest.
-    Meanwhile, SCEH is providing a telephone hotline to answer public enquiries.
-    So far no complaint from account holders has yet been received about actual losses arising from the data leakage.

4.    To assess if SCEH has taken all practicable steps to protect the customer data against hacking, the Commissioner asked SCEH to provide a detailed account of the incident as well as its data security measures. SCEH undertook to provide the information to the Commissioner for investigation within 3 days.

5.    The Commissioner also required SCEH, before resumption of the PSN services, to upgrade the security protection of the PSN to a satisfactory level to ensure similar incidents will not happen.

6.    “While my office will continue our investigation work, I strongly urge the PSN account holders to stay alert to protect against possible identity theft and financial and other possible losses that might arise from the data breach. As likely targets of phishing attacks, they should be vigilant in responding to unsolicited requests for information regarding their personal identities and credit cards. They should be particularly wary of e-mails and calls that purport to come from Sony and which ask for credit card or other sensitive information. They should also watch out for possible fraudulent activities on their credit card that Sony had on file.” Mr. Chiang said.

END