When the PlayStation Network first went down, it was unclear if this was due to yet another DDoS attack or something more sinister. Sony finally came clean yesterday, revealing that personal information linked to every PSN account may have been compromised, which may or may not include financial information. The amount of time elapsed until this was made public knowledge has caught the ire of at least one U.S. Senator.
Senator Richard Blumenthal, a Connecticut Democrat, recently sent a letter to SCEA CEO Jack Tretton. The letter is mostly aimed at Sony’s inability to immediately notify users “about whether and to what extent their personal and financial information has been compromised.” Mr. Blumenthal also made a suggestion to Sony to offer PSN users complimentary “financial data security services, including free access to credit reporting services, for two years,” as well as insurance. The letter appears to have been written before Sony’s blog posting and subsequent e-mails went out, though it is dated as the same date as the aforementioned communications from Sony, so it likely had nothing to do with the timing of the postings. Take a look at the entire letter below, and let us know your thoughts:
Dear Mr. Tretton:
I am writing regarding a recent data breach of Sony’s PlayStation Network service. I am troubled by the failure of Sony to immediately notify affected customers of the breach and to extend adequate financial data security protections.
It has been reported that on April 20, 2011, Sony’s PlayStation Network suffered an “external intrusion” and was subsequently disabled. News reports estimate that 50 million to 75 million consumers – many of them children – access the PlayStation Network for video and entertainment. I understand that the PlayStation Network allows users to store credit card information online to facilitate the purchasing of content such as games and movies through the PlayStation Network. A breach of such a widely used service immediately raises concerns of data privacy, identity theft, and other misuse of sensitive personal and financial data, such as names, email addresses, and credit and debit card information.
When a data breach occurs, it is essential that customers be immediately notified about whether and to what extent their personal and financial information has been compromised. Additionally, PlayStation Network users should be provided with financial data security services, including free access to credit reporting services, for two years, the costs of which should be borne by Sony. Affected individuals should also be provided with sufficient insurance to protect them from the possible financial consequences of identity theft.
I am concerned that PlayStation Network users’ personal and financial information may have been inappropriately accessed by a third party. Compounding this concern is the troubling lack of notification from Sony about the nature of the data breach. Although the breach occurred nearly a week ago, Sony has not notified customers of the intrusion, or provided information that is vital to allowing individuals to protect themselves from identity theft, such as informing users whether their personal or financial information may have been compromised. Nor has Sony specified how it intends to protect these consumers.
PlayStation Network users deserve more complete information on the data breach, as well as the assurance that their personal and financial information will be securely maintained. I appreciate your prompt response on this important issue.
Sincerely,
/s/
Richard Blumenthal
United States Senate
Is the Senator right in his demands? Should Sony offer some sort of security and/or insurance services to PSN customers affected by this security breach? Stay with PlayStation LifeStyle for more on this as it develops.
