Sony: 10 Million Credit Cards May Have Been Exposed 251
WrongSizeGlass writes "The LA Times is reporting that Sony has revealed that 10 million credit card accounts may have been exposed two weeks ago when a hacker broke into the company's computers in San Diego and stole data from 77 million PlayStation Network accounts. Sony said it will provide credit card protection services for the 10 million customers whose data were compromised. Sony last week said it had encrypted credit card data, but not other account information, including names, addresses, email addresses and birth dates."
Fundementally broken system (Score:5, Insightful)
I know this is beating a dead horse... but the core problem here isn't Sony's epic failure... it's that the credit system is so broken that this information that was stolen is enough to seriously fuck with someones life.
I'm not trying to downplay Sony's screw up. I have a PSN account and as such am suitably nervous. This whole thing just reminds me of how messed up our system is.
Re: (Score:2)
I know this is beating a dead horse... but the core problem here isn't Sony's epic failure... it's that the credit system is so broken that this information that was stolen is enough to seriously fuck with someones life.
I'm not trying to downplay Sony's screw up. I have a PSN account and as such am suitably nervous. This whole thing just reminds me of how messed up our system is.
Speak for yourself... due to the economy, there is no way that someone could use my identity to fuck my life up worse than it already has been... speaking of which, if they had a credit card for me on file, the thing is most certainly invalid by now...
Re:Fundementally broken system (Score:5, Interesting)
The Credit Card system could be done a lot better. Sony shouldn't need your CC number, all they should need is a magic number that authorizes Sony to transfer funds from your account to theirs. I think that what should happen is something like this:
. I go to Sony's website and sign up for a PSN account
. Sony give me their billing number and ask for an authorization number
. I go to the bank, log in to my account, and request an authorization number against Sony's billing number, for a maximum amount (eg $50/month)
. I go back to Sony's web page and enter in the authorization number and maybe some other identifying details (eg my banks number)
Sony now has a number that is _only_ good for transferring funds from my account to theirs. If someone obtained that number then the worst they could do with it is transfer up to my limit of $50/month to Sony.
It's not bulletproof but at least Sony don't have my CC number to share with the rest of the world.
Re:Fundementally broken system (Score:4, Interesting)
Such a system already exists. It was developed by an irish company called Orbiscom which was recently bought-out by Mastercard.
It's got different names - disposable credit cards, one-time use credit cards, Controlled Payment Numbers [wikimedia.org], etc. Bank of America call's theirs ShopSafe, [bankofamerica.com] Citibank calls theirs Virtual Account Numbers. [citibank.com] I believe PayPal and Discover have their programs too -- all based on Orbiscom's technology.
It works pretty much exactly the way you described - you log into your account, generate a new CC# with a maximum limit and expiration date that you specify. Then the first merchant account that posts a charge to the number becomes the only merchant account that post any more charges to that number. So even if the number does get stolen, it isn't any good to the thieves. Other than those limitations, for all intents and purposes, it is just a regular credit card. Most merchants can't even tell the difference.
I've been using ShopSafe for well over a decade now and have never had a fraudulent charge. The only problems I've had have been when the merchant is sloppy and double-charges with the intent of cancelling the first charge - Parts-express.com is the only merchant that I know which does that for all of their transactions and fixing it was simple enough - I just double the max limit on the CC#.
Re: (Score:3)
Re: (Score:2)
The point is that the "magic number" would be different for each purpose (i.e. generated by you for this transaction with Sony).
The key here though is not the technological hurdles - it'd be relatively easy to come up with a better system. The problem is that its not cheaper for Visa et al to switch - and they have no incentive to do so. The system as designed puts the economic burden on the merchants (and then the consumers) leaving the "cardtels" unscathed.
Until that externality is addressed, we will cont
Re: (Score:3)
You mean like a virtual credit card number, available -- for example -- from citi in at least the U.S. market? That's precisely what it is: a credit card number generated on the fly, with an expiration date and spending limit that you select, that locks to the first merchant that will charge it. The latter is because it's generally impossible for a 3rd party to know how the merchant will identify themselves to the credit card processor.
Re: (Score:2)
No, said number would only be valid for a particular payee, for a particular period of time, for particular amounts at particular intervals.
Kind of like how a gpg/smime email is protected by a signature, and not by mailing copies of your private key all over the place.
The problem with credit cards is that they authenticate transactions with a shared secret that you share with everybody you do business with. That is 1940s technology.
Re: (Score:2)
The problem is that this is not the same thing as what was discussed earlier. There's no limits (other than to the limit of your acct or the daily limit if it's a debit card...) and it's not Credit he's describing, but more of a very, very limited ACH transaction.
Let the processor store them (Score:3)
One solution is to let the payment processor store them.
I recently implemented an online payment system for a rather large client. We didn't want to store credit card numbers but had a need to process additional charges at a later date.
We used Paypal's Payflow Pro product (formerly offered by Verisign). They have a feature that allows you to store a reference number with any successful transaction processed. When you want to submit an additional transaction, you just supply this reference number along with
Re: (Score:2)
The problem is that you're centralizing the stuff to the payment processor now- which while it's more secure, it's a much more lucrative target. Effort's vastly higher, yes, but the payoff's porportionate.
Re: (Score:2)
Re:Fundementally broken system (Score:5, Interesting)
Two big changes that would help:
1. Make companies legally liable for data losses that are worsened by the companies own negligence. In the Sony case, they've already admitted the breach occured due to a known vulnerablity that they failed to patch. There's also been some suggestion they were storing CVV2 numbers, which they're expressly told not to do by the credit card providers.
2. Make companies that process obviously fraudulent transcation liable for the losses instead of the card holder. E.g. if someone comes in and starts buying a ton of gift cards with an out of state credit card, and you don't do anything to verify their identity.
Re: (Score:2)
Re: (Score:2)
beating wrong horse (Score:5, Insightful)
What would fix this is to have credit cards generate a contract not tap an open vein. that is, the credit card is used to authorize a one time transaction (after which the credit card number itself can be discarded for the transaction ID). For recurring charges the transaction authorized should only enable payments to sony, for goods provided to a specific address or online account, and include a cap. that is non-transferable transactions are the thing we should keep on record.
There needs to be a mechanism for generating these transaction IDs.
Re: (Score:2, Interesting)
Re: (Score:2)
right, I've heard of this. But it's unappealing because it pushes the nuiscance on to the user. It also isn't universal, it's linked to citi cards, so you can't push this onto the merchant (otherwise there could be 200 different interfaces to deal with).
But the idea is notionally correct.
Re: (Score:2)
here in germany I just go to a supermarket, buy a pre-paid credit card and put some credit on it, right on the moment to pay for it. If I want, I can reuse it, or else, I just throw it away.
Re: (Score:2)
In Portugal we have a system that allows you to generate any number of credit cards with a defined spending limit and with 1 month expiration dates.
More than that, you don't even need to own a credit card and pretty much every bank has access to it-
It doesn't get much better than this for web transactions.
Re: (Score:2)
Many payment gateways offer just such this service. For example, if I as a merchant process a transaction through my merchant account, I don't actually get the card number. The customer enters their card number onto the payment gateway's processing page, and I am simply notified of the transaction outcome. However, if I indicate that I want recurring payments, then I am provided a token which I use in place of the card number (which I don't know) in order to re-charge that card. That token is unique to
Re: (Score:2)
um. your bank is on the hook for any fraudulent charges why the fuck do you think they work so hard to detect fraud? - banks don't care about customers. they do care very much about THEIR money. I normally spend less than $200 bucks per purchase on my credit card.. one day, I bought a TV.. there was a call from my bank on my answering machine BEFORE I GOT HOME. they had suspended my card until I could call to verify the charges. same thing happend when i went on a shopping spree and ran up a half dozen char
Re: (Score:2)
To use an example elsewhere in this comment section, someone went into a Home Depot in another state and bought six $100 gift cards. That should raise a red flag at the store.
Re: (Score:2)
The bank isn't liable, the merchant is. The bank is only liable for Card Not Present transactions where 3DS authentication was attempted and either not supported or succeeded.
Re: (Score:2)
More rigorous checks required for issuing credit and much tighter regulation over credit reporting?
I'm not downplaying capitalism or the economy or anything here... just the way the credit system works.
No it isn't.. (Score:5, Interesting)
An alternative is easy in concept, but the satus quo has the industry in a strangle hold. It's not like even a large consumer group acting together could *change* things from 'outside'
We are talking about 16 'secret' numbers that allow whoever figures them out to charge however much they want against your account. Occasionally an additional view on the back are needed for some retailers, but at the end of the day to even buy $5 of something with your card you must trust the seller to not do bad things with your account *and* keep it safe from others. This might have been about the best you could do when the seller was doing a carbon copy and would phone in the slips at the end of the day, but now everyone *immediately* contacts a server for validation and nearly every person with a card also has a pocket sized computer device capable of independently talking to bank servers. It's completely reasonable to have point-of-sale equipment that pairs with a phone and have the phone connect directly to bank servers to *specifically* authorize a transaction amount and have the PoS verify that data as well without such a silly use of an account number and just exchangine public keys and per-transaction authorization data.
The common defense is "oh, well, most card companies don't hold the customer liable for everything", ignoring:
-Some companies will hold the cardholder liable for some of it
-Sometimes they may argue that the cardholder didn't act promptly or other circumstance
-Even when everything works as 'promised', there is a cost incurred *somewhere* and that impacts you, either in higher interest rates on credit, lower interest rates on checking, and/or merchant prices due to processing fees. I'm about convinced this last one is the biggest motivation not to change, they play funny games with margin and can blame identity theft.
Comment removed (Score:5, Insightful)
Re: (Score:2, Flamebait)
The systems used in almost every other country in the planet.
Why is it that Americans use ignorance as an argument? "I don't know any better, so therefore, there can't be anything better." When it's almost always "I don't know any better because I'm an idiot and, for some bizarre reason, quite proud of my ignorance such that I reveal it on public forums on a regular basis."
Re: (Score:2)
Re: (Score:2)
What system is that smartass.. You are just, making shit up now. I spent 10 of the past 12 months out of the US in 14 different countries on four different continents and have not seen anything remotely relevant to solving the problem of someone using a stolen credit card number or someone stealing a credit card number from a database. Sony is not even a US company....
So tired of arrogant Europeans. I know your European because your a dips hit. Ohh look at me I am so worldly I made a trip that is almost
Re: (Score:2)
Re: (Score:2)
I have no idea what undefined system that GP is talking about, but here in NZ we run a system in parallel with the Credit system called "EFTPOS", which is similar to a credit system in that you have a card, and you swipe it at a shop to make a payment, but that's where the similarity ends. Basically, it absolutely requires a PIN. Simply won't work without it. As well, the money is settled directly between your bank and their bank, and it actually transfers money (from your bank account, not some credit a
Re: (Score:3)
The most simple alternative would be single-use credit card numbers and while some credit card companies offer those for single transactions, they don't offer them for recurring transactions, i.e. you want a number that only allows Sony to get your money, but not anybody else. Those a stolen Sony-only number would be completely useless.
I mean seriously, we are living in a age of hi-tech and yet still let so much depend on a single number that you can't even keep secret, as you have to give it to anybody fro
Re: (Score:3)
I'd give an alternative... nonces. These are used as IDs which are mapped to a credit card processor for subscriptions that are easily cancellable by the user.
This way, the user sets up a subscription. They get passed to the clearinghouse to enter in info (perhaps authorizing with two factor authentication.) The place offering subscriptions gets an ID back that they can use for cancelling a subscription (if someone got banned), or refunding all/part of a sub.
Worst that can happen if the blackhats get th
Re: (Score:2)
My payment gateway does exactly this - I simply cannot get the card number without asking the user, and if I want a recurring transaction, then I am given a token unique to my merchant identity which I, and only I, can use to charge that customer. Anyone else could use it to either refund or give more money to me. The gateway doesn't allow customers to cancel it though, as they are an actual merchant payment gateway, not like PayPal - they aren't set up to actually deal with customers.
Re: (Score:2)
Simple - credit card has an embedded private key. Merchant transmits to card transaction details, card displays summary of transaction on its LCD screen, cardholder types PIN onto card's keypad (NOT a merchant's keypad), and card gives the merchant a signed authorization. Merchant presents authorization to the bank.
Transactions that can be authorized can either be single-use or recurring, with the parameters of recurring transactions defined in advance (max amount and interval). Transactions are always t
Re: (Score:2)
That would be nice.
Perhaps it would be good to have a small device about the form factor of a credit card:
It would have a PINpad and a fingerprint scanner (the scanner is for the equivilent of a day-lock on a safe -- protection while the device is unlocked.)
Then, using NFC or even BT, a sales transaction would post a prompt on the card stating that this mechant that had its name and key signed by this CA wants to charge this card in the list $amount (or an amount in CDS, but translated to USD). If the user
Re: (Score:2)
they are required to use to make an online purchase
Unless they arn't.
Seriously.. when verified by visa came out I thought: awesome.. that makes sense.
Until I realized it was optional on the merchant side. It's to protect the merchant from accepting fraudulent claims, not the card holder. Someone with your card can just use it at places that don't require verified by visa.
I really wish you could opt-in to some kind of "only accept online payments if verified by visa in use" or something. Maybe you can with some? I've asked.. you can't with mine :S
Re:Fundementally broken system (Score:4, Interesting)
The big deal is that your credit rating is determined by 3 private entities that have no practical oversight. Once you are subject to a fraudulent claim, you are screwed. There is no recourse and no way to clear your record.
I have a fraudulent claim by a bogus company on my record. I have no way to get them removed. They claim that I defaulted on a judgement; none of which is true. I've been told it would cost over $50K in attorney fees to try to get this removed.
So yes, maybe you can get your money back from Master Card or Visa, but basically you can be screwed on your credit rating for years.
Re: (Score:3)
This is a company that does this for a living. They're located in Texas, a state known for notoriously weak consumer protection. The contract in question was signed in SC, the "collection agency" is in Texas, and I live in Oregon. No state AG will take this on. The feds aren't interested. I've checked.
The company is infamous for this behavior; they move every 6 months to make it more difficult to serve papers on them. They essentially extort money from people and if you don't pay they file a fraudulent
But the big question is... (Score:3)
Re:But the big question is... (Score:5, Insightful)
They previously announced that no credit card numbers were compromised. Can we get some outside verification on this because they obviously have no issue with lying to us.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you actually look at what was ACTUALLY said:
There have been 10 million cards used on PSN. They've continued to claim that this information was not only encrypted, but stored separately from the information that was compromised. They do not believe that even the encrypted data was accessed, but if they are wrong they will cover any costs people incur in correcting the problem.
This is what they said here, not necessarily what is true. Still, it seems to me that this particular story is misrepresenting Sony
Re: (Score:2)
They previously announced that no credit card numbers were compromised. Can we get some outside verification on this because they obviously have no issue with lying to us.
Where does this "news" say a credit card number was compromised? It's just a rehashing of what we already know with stupid wording.
Or maybe you can tell me what this "credit card protection service" is? There is no such thing. It's "credit protection", because of the names, addresses, birth dates, etc that are known to be compromised.
Moron.
Re: (Score:2)
The reply right above yours here gives this link; you should read it and then rethink your first question...
http://173.255.232.215/logs/efnet/ps3dev/2011-02-16#1141 [173.255.232.215]
they never said no CC#s were compromised (Score:5, Informative)
Sony never said no credit card numbers were compromised, they said that credit card numbers were in a separate encrypted database and probably were not accessed. But they can't be sure.
And they are saying the exact same thing now.
Re: (Score:2)
About 2 comments up for yours here is a guy who gives a link that shows that Sony transmitted the CC numbers in plain text....so perhaps Sony has been, I dunno, lying.
http://173.255.232.215/logs/efnet/ps3dev/2011-02-16#1141 [173.255.232.215]
Re: (Score:2)
Assuming a good hashing scheme: the 15 digit card number (the 16th is the checksum) + 3 digit cvv2 + an expiration date somewhere in the next 3 years (36 values) gives about 64 bit of entropy. That's clearly within a botnet's capabilities to attack via bruteforce if it's a plain MD5 or so, and not a computationally expensive algo like bcrypt. Since there are 10 million stolen cards, assuming they didn't use a salt then you get a valid card number with a 41 bit attack which can be quickly performed on a sing
I'm sure it will all be okay. (Score:4, Funny)
Say it aint so! (Score:2, Insightful)
Re:Say it aint so! (Score:5, Insightful)
What I recall hearing them say was that they couldn't rule out the possibility that they had been exposed, but that they couldn't at that time confirm that it had happened either. I know we all like trolling Sony because they deserve it, but at least pick one of the many valid reasons for doing so, rather than making up one that doesn't exist.
Re:Say it aint so! (Score:5, Interesting)
It's a good thing I already changed my credit card number and all of my passwords, just in case.
By the way, I just happened to use the same login and password on the PSN as I did for my GMail account. Gmail informed me the other day that someone had accessed the account from an IP in China. That when I started changing EVERYTHING and started watching my accounts like a hawk.
Re: (Score:3)
Re: (Score:2)
Sony, I thought you said no CC numbers were exposed!
Q&A #1 for PlayStation Network and Qriocity Services [playstation.com]
Q: Was my credit card data taken?
A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.
Re: (Score:2)
Sony, I thought you said no CC numbers were exposed! How will we ever trust you again when you lie like this? A month of PSN Plus you say?
There is no news in the article, just a rehashing of what we've been already told, "out of an abundance of caution...", "... may have ...", etc.
There is no such thing as "credit card protection service", the dumb author meant "credit protection", which is offered due to the information we DO already know was compromised.
I'm not optimistic enough to not ask for new cards to be issued, that is the smart thing to do anyways.
But, there's no excuse for you running your mouth like a fucking retard.
Re:Say it aint so! (Score:4, Interesting)
Given the number of breaches in various companies that have led to information being compromised, I think the better question is why do we let them store more information than absolutely necessary? There's no legitimate reason for Sony to be storing that information for most users. One could make a case for those that pay for PSN Plus, but for people who only buy a game now and again, there's absolutely no reason for them to store it. It's not that hard for people to type it in again.
I mean for heaven's sake, if GOG [gog.com] doesn't need to store credit card information to stay in business, why does Sony?
Re: (Score:3)
There is a reason, the same reason every major online retailer under the sun remembers credit cards until you tell them otherwise.
The issue is not storing the number, but keeping it safe. Every large merchant is supposed to follow PCI DSS standards, which make mass copying of credit card data extremely difficult for attackers, or even lone trusted insiders. If the card encryption keys can be obtained by a single member of the organization, the system is not PCI compliant. Very large merchants, like Sony pro
Still won't stop people (Score:5, Insightful)
Re: (Score:2)
Will I be dumb enough to become one of those muppets again?
I don't know. How long do you remember stuff like this and when is the next Playstation coming out?
Re: (Score:2)
I have a simple solution to "trusting those muppets"... Just use prepaid PSN cards. Available everywhere Sony crap is sold. Then you're only on the hook for crank calls should your data ever be compromised again. :)
Re: (Score:2)
You may not be aware of this, but Sony is on the brink of bankruptcy since at least 15 years. In 2004, I already got told by Sony employees, that they were 10 years in that struggle. Not much has change since then. It's really not a big kick that's needed to kill them. This, for example, could already be it, if one other bad thing happens. And I have no doubt that the bad work quality is a result of bad morale inside the company because of having to live with a very tight belts for so long.
Darn you! Now if I short Sony stock, it's insider trading.
Ok (Score:5, Interesting)
Why does everybody collect and store all these data centrally?
Just store it locally, on the playstation, electronically signed and encrypted in a way that the customer has to enter a passphrase to decrypt it when its really needed. make the "it is needed" message also necessarily signed by an independent system with no other function. Let this system do a statistic. trigger an alarm if the number of signatures per minute is deviating significantly from the expected number.
Re:Ok (Score:5, Insightful)
Why does everybody collect and store all these data centrally?
For recurring payments. With your scheme, every user would have to enter their password every month. The biggest problem for Sony would be that everyone would be making the decision to continue paying for the service every single month. If the number is on file, then the customer has to go out of his way to cancel, but has to do nothing to stay a customer.
Re: (Score:2)
Well to be honest *I* would not mind to enter a password one per month to legitimate payments if that keeps my data safe.
Re:Ok (Score:5, Insightful)
Re: (Score:2)
It wasn't for recurring payments, originally. Their original system used this crazy wallet thing where you'd have to load money onto your account, and then you could spend it.
They changed it so that you later just saved a credit card and could automatically load exactly the amount you needed onto your wallet without going through the whole "load wallet" step. (Which also meant that for the first time you didn't need to spend in $10 increments. Or was it $5? You get the point.)
To make things easier, they aut
Re: (Score:2)
Yes, nobody ever plans ahead.
Re: (Score:2)
Making purchases simple creates so much revenue that it's worth almost any risk. Even if Sony had to pay every dime of
Re:Ok (Score:4, Insightful)
Why does everybody collect and store all these data centrally?
Because "paying for stuff" isn't the only reason Sony collects your data. There's also advertising (especially targeted/predictive), data mining, data sharing (both internally and externally), tracking/trending, etc. I think that data is a lot more valuable sitting on their servers than it is hidden in your console - hence, whatever the cost, it will remain there. That really goes for any internet aware service, not just Sony/PSN.
Re: (Score:2)
not just theory (Score:5, Interesting)
Re: (Score:3)
Another possibility could be that there are a lot of stolen CC numbers out there, but the thieves are biding their time so as not to draw unwanted attention. However, now that this PSN thi
Re: (Score:2)
Of course, not that I'd necessarily trust Sony after their lack of honesty and transparency throughout this fiasco ("oh just a PSN outage / actually some account info has been stolen / actually CC info has been compromised").
I really don't see any lack of transparency, nobody sane would disclose a security breach while they are still investigating it, even open source software don't do that, for example in kde vulnerabilities are kept "secret" in the packagers mailing list for some days so every distro has the time to patch up and then they are disclosed to the public
Re: (Score:2)
As of a couple days ago, the CC security people were saying there was no indication the card info had been used. If someone steals 10 million credit card numbers and tries to use them, it gets noticed.
From most likely to least, your problems are:
- a coincidence that happened during the 12 days since the breach or
- a complete fabrication or
- the only card (or one of the few cards) the hackers decided to use or
- the first report in the pattern that the banks and card companies are looking for.
Too bad dude.
Re: (Score:2)
Seriously? A debit card tied to your primary checking account used to pay for DLC?
Epic fail dude.
In other news, it's a woman's fault if she gets raped; that's what she should expect, wearing such a skimpy outfit.
Not news (Score:2)
This is not news. It was already posted on Slashdot. The only new item is that only 10 million of the 77 million accounts had credit card information associated.
BTW: Sony has said there is no evidence the intruders got CC info, but they can't rule it out either.
Re: (Score:2)
The best thing that comes out of all these breaches is the consequences of assuming the worst - Gary McKinnon, looks for UFOs, causes 6-figure damages because any machine he was within 1000 miles of pinging got tossed into a shredder. Likewise, with this, you know there's some hacker out there who's all like "shit, I missed that database, I was only in there for info on the PS4"
Re: (Score:3)
That's what I was wondering about. I don't think that I've paid for anything via PSN, if I buy a game, I do it as disc and so it's unlikely that Sony has any information beyond my contact information. And let's be honest about that, it's been lost to crackers at least 3 times at this point, and I think it's probably been a few more times than that.
May have been? (Score:2)
Finally, adequate response (Score:2)
Woah, some executives bowed in apology? That makes everything better now! All is forgiven, and we* can get back with our lives now.
They were in the prison shower with Bubba standing behind them when this happened, right?
* - "We" refers to each individual PSN member and the guy who's running around with the PSN member's ID and credit card.
Re: (Score:2)
that would have been more entertaining, but equally as useless
Encryption (Score:2)
Re:Encryption (Score:4, Informative)
As for the cryptanalysis problem, simply use a salt the same size as the card number and XOR the card number with it. Presto, perfectly random looking plain text with no (new) differential cryptanalysis vulnerabilities. You don't even need to do this if you use proper initialization vectors and a block cipher in CBC mode
Re: (Score:2)
(my favorite variation is where the database has a decryption stored procedure)
So? What matters is how you protect the key. I don't think you really understand the reasoning behind doing that which is protecting data at rest.
You're also just throwing random things out there without knowing what the PSN transaction processing backend really looks like. At this point, you do not know if any cardholder information was compromised outside of name & address. You don't even know if the address or name are from the PSN profile or CC account. You don't know if they violated any PCI g
Re: (Score:2)
PCI Compliance required (Score:2)
Re: (Score:2)
At best it typically means there is one additional server that needs to be compromised before the whole lot is exposed. Encryption is of course a useful tool but it is not a magic bullet.
New Information Revealed (Score:5, Funny)
It has been revealed that the whole problem began when a PSN admin inserted a Sony music CD. The installed rootkit then allowed hackers to access the network.
Similar to the (alledged) Wikileaks dump (Score:2)
so.. (Score:2)
I probably missed it, but... encrypted with what? (Score:2)
...with rot13.
Deleted? (Score:2)
I'm curious if you're at risk if you deleted your credit card info recently. A few days before the attack, I logged in to PSN on a friend's PS3. I didn't remember which card I had tied to the service, so when it asked me to confirm, I went ahead and said "delete credit card info". So, I guess we'll find out if Sony actually physically removes the data...
Taking a page from the Catholic church (Score:2)
Re: (Score:2)
No, it's 10 million out of 77 miilion PSN subscribers, so the chances are 1 in 7
Re: (Score:2)
77 million PSN subscribers, but not necessarily individual people. Chances are there are millions of duplicates or child accounts that share the same credit card number.
Re: (Score:2)
Re: (Score:2)
Who cares? I'm LOVING reading this story on RockMelt (TM)!
Re: (Score:3)
I have had data breaches happen to my personal data multiple times at a big-ten school in the U.S., *and* at a big-ten school's medical center. There was always a press release, then a delay of a couple of days, then an personalized email with link & pin to start a year's worth of service with some credit protection service provider.