Sony admits that approximately 6,800 employee data was leaked due to security breach



Sony Interactive Entertainment (SIE), which operates the PlayStation brand under Sony, has admitted that the personal information of its employees and former employees has been leaked. According to reports, the personal information of about 6,800 people has been leaked, and SIE has notified the relevant parties that the data has been leaked.

Sony confirms data breach impacting thousands in the US
https://www.bleepingcomputer.com/news/security/sony-confirms-data-breach-impacting-thousands-in-the-us/



Sony confirms server security breaches that exposed employee data - The Verge
https://www.theverge.com/2023/10/5/23905370/sony-interactive-entertainment-security-breach-confirmation

CVE-2023-34362 , a zero-day vulnerability in the file transfer service MOVEit Transfer discovered in May 2023, is a high-severity SQL injection- related flaw that can lead to remote code execution. It has been reported that the ransomware group Cl0p, which exploited this vulnerability, threatened hundreds of companies with ``revealing confidential information'' in June 2023.

When the ransomware group ``Cl0p'' reveals confidential information to hundreds of companies, it issues a blackmail ultimatum, threatening the BBC and airlines, leading to a huge incident and the deadline approaching - GIGAZINE



Cl0p then added Sony Group to its list of victims in late June 2023, but Sony had not made any public statement regarding this ransomware attack.




According to reports, Sony's systems were compromised by Cl0p on May 28, 2023, and three days later, Progress Software, the developer of MOVEit Transfer, informed them of the zero-day vulnerability5. Apparently it was the 31st of the month.

'On June 2, 2023, Sony discovered evidence of an unauthorized data download and immediately took the platform offline to remediate the vulnerability,' a notice sent by Sony to employees affected by the data breach said. It seems to be written as 'I did.' Sony has since begun an investigation with the assistance of external cybersecurity experts, and has also informed law enforcement agencies about the data breach.

In addition, Sony said that only specific software platforms were affected by this data breach, and other systems were not affected.

According to the official website of the Attorney General's Office of the State of Maine in the United States, the total number of victims of this data breach is 6,791, of which four are residents of Maine.

Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security Breaches
https://apps.web.maine.gov/online/aeviewer/ME/40/8b595be6-d1d7-47df-84d5-05738edd84f9.shtml



Separately, ransomware group Ransomed.vc claims to have hacked every system at Sony, including screenshots of Sony's internal login page and an internal PowerPoint presentation outlining test benchmark details. It claims to have access to 6,000 files owned by Sony, including documents and multiple Java files.

Ransomware group claims to have hacked all of Sony's systems - GIGAZINE



Regarding the security breaches mentioned above, a Sony spokesperson said, ``We are currently investigating the latest allegations related to security incidents regarding our company. We have identified activity on a single server located in Japan that is used for internal testing. As the investigation is ongoing, we have taken this server offline. At this time, no customer or business partner data is affected. There is no indication that the data was stored on the affected servers or that any other Sony systems were affected.Therefore, there has been no negative impact on Sony's operations.'

Related Posts:

in Security, Posted by logu_ii