PlayStation Network Security Breach: A Survival Guide
By Ian Paul
Apr 27, 2011 6:31 am PDT
Sony has quite the security nightmare on its hands with its giant PlayStation Network disaster.
Sony finally admitted Tuesday that account details, logins and online IDs for registered Sony PlayStation Network users, as many as 77 million people, have been compromised. The information was stolen sometime between April 17 and 19, according to a Sony blog post, as early as nine days before Sony notified its users of the breach. Even worse, the company says it can’t be sure whether credit card information was stolen.
The admission came nearly a week after Sony pulled the plug on PSN and its Qriocity music service, blaming the outage on an “external intrusion” into Sony’s network. Sony says that it is rebuilding the PSN and Qriocity server system with improved security. Both services are expected to be operational within the next week.
The fact that it took the company almost 10 days to figure out and then admit that user data had been stolen is troubling to say the least.
If you’re a registered PSN user, the implications for you and your online information is quite serious. Here’s what you need to know:
What The Bad Guys Know About You
Sony said the following user information was compromised: your name, address (city, state, zip), country, e-mail address, birth date, PlayStation Network/Qriocity password and login, and handle/PSN online ID.
It’s also possible, according to Sony, that hackers obtained your PSN purchase history, billing address (city, state, zip), and password security answers.
If that wasn’t bad enough, it’s also possible your credit card information was stolen, including your card number and expiration date. “While there is no evidence at this time that credit card data was taken,” Sony said, “we cannot rule out the possibility.” Your credit card’s security code (typically a three-digit number on the back of your card) was not compromised, according to Sony.
Your Kids’ Account Is Compromised, Too
Sony also warns that if you have a sub-account for a minor attached to your PSN credentials, that account is probably toast as well.
What to Do
There are several measures you should take to ensure the integrity of your data. First, considering how long it took Sony to warn its users, it’s probably best to assume that all of your information needs to be changed as soon as possible. This isn’t meant as a scare tactic, but the fact that hackers may have obtained your PSN data nearly 10 days ago means they have a huge head start on using that data for malicious purposes.
Sony is also warning users to be wary of people calling or e-mailing you for extra information such as your Social Security number or other personal information. Sony says it will never call you asking you to verify your information. You should also be wary of people claiming to be from other companies or services looking to verify your personal data.
Watch Those Credit Cards
Next, you’ll want to decide what measures you want to take to secure your credit card information. You can either monitor your card for suspicious activity, or, if you can manage without your card for a few days, you may want to consider canceling it and getting a new one.
Sony also advises that you may want to place a fraud alert on your credit record with the three major U.S. credit bureaus. This will make it harder for someone to open a new credit card in your name (remember they may have your name, billing address and birth date). To find out how to contact the credit bureaus see Sony’s blog post.
Next, you’ll want to review your online passwords to see whether you are using the same password and login ID across multiple accounts. If, for example, your PSN and e-mail logins are the same, change your e-mail address password immediately.
Many people often use one difficult password across multiple online accounts, because it’s easier to memorize just one set of credentials. If that sounds like you, I highly recommend you try a password manager such as LastPass (my personal preference) or KeePass. That way you can use as many difficult passwords as you want without having to memorize all of them. If you use multiple devices during the day such as a laptop, desktop, tablet (iPad or Xoom) and smartphone, you may want to look for a password manager that has software available on all the platforms you use.
For an added dose of security, you can also use two-factor authentication on accounts that support them. Two-factor authentication basically means your account requires a randomly generated password in addition to your regular password before you can access your account. The second password is usually generated by an extra piece of software, authenticated by you, on a keychain dongle or smartphone app. This makes it harder for hackers to break into your online accounts.
Sony hasn’t detailed if it will require extra authentication steps from you the first time you login to PSN after it comes back online. But make sure that you login as soon as the service becomes available and change your password.
When security breaches like this happen, it’s best to play it safe and take precautions to safeguard your data in case it has fallen into the wrong hands. And if nothing bad happens to you, at least you took the time to review your online security management practices, which is never a bad thing to do from time to time.
Connect with Ian Paul (@ianpaul) andToday@PCWorldon Twitter for the latest tech news and analysis.
