The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.
That’s from the news, analyst and Sony PR reports that are coming out about the PlayStation Network/Qriocity breach. Does anyone trust Sony’s statement that the credit card data was not ‘taken’? If attackers got the entire customer database, wouldn’t you think they grabbed the encrypted card numbers and will attempt to crack them later? Is the comment about “a very sophisticated security system” supposed to make customers feel better, or to generate sympathy for Sony? Does labeling their breached security system “very sophisticated” reduce your faith in the likelihood their crypto and key management systems will withstand scrutiny? How many of you thought the name “Qriocity” was defacement the first time you read the story?
My general rule over the last three years is to not write about breaches unless there is something unusual. There are just too many of them, and the questions I asked above could apply to any of the lame-assed breach responses we have been hearing for the last decade. But this one has plenty of angles that make it good spectator sport:
- It’s new: It’s the first time I have seen someone’s network hacked through a piece of dedicated hardware – of their own design.
- It’s old: It’s the classic (developer) test environment that was the initial point of entry and, just like so many breaches before it, for some mysterious reason the test environment could access the entire freakin’ customer database.
- It’s new: I can’t think of another major data breach that will have this degree of international impact. I’m not talking about the fraud angle, but rather how governments and customers are reacting.
- It’s old: Very little information dribbling out, with half-baked PR “trust us” catchphrases like “All of the data was protected …”
- It’s new: Japanese culture values privacy more than any other country I am familiar with. Does that mean they’ll develop the same dedication to security as they do quality and attention to detail?
- It’s old: It’s interesting to me that a culture intensely driven to continuous improvement has an oh-so-common allergic reaction to admitting fault. Sure, I get the ‘blameless’ angle written about in management texts throughout the 80s, but the lack of ownership here has a familiar ring. Obviously I was not the only one thinking this way.
- It’s new: We don’t, as a rule, see companies basically shut down their divisions in response to breaches, and the rumored rebuild of every compromised system is refreshing.
- It’s old: Their consumer advice is to change your password and watch your credit card statements.
Ultimately I am fascinated to see how this plays internationally and if this breach has meaningful long-term impact on IT security processes. Yeah, not holding my breath either.
Reader interactions
3 Replies to “What’s Old Is New again”
I’m curious as to how these fraud alerts have been traced to the sony breach. My initial reaction, given the large number of people impacted and following the law of parsimony, is that the alerts are coincidental or an example of “recentism”. Is there any evidence to counter such an assumption?
Dre –
I think you’re right, it’s all hearsay, and apparently I am hearing the same rumors as you are. It is looking more likely that there are some instances of CC fraud associated. So were some of the numbers sniffed during the intrusion prior to storage/encryption? Guess we are not going to know for a while yet, but I am willing to bet the credit card fraud departments have a clear picture from their fraud models but have yet to make a statement one way or another.
-Adrian
While I think the 22M validated payment card dump to the underground is hearsay, there have been a string of recent fraud alerts all over the world that have been traced to the Sony breach.