PlayStation Network, down since April 20, will return beginning with limited services "this week," said Kazuo Hirai, the second-in-command for Sony Corp., at a news conference today in Tokyo.
When PSN comes online, users will face a mandatory system software update that requires all PSN users to change their account passwords before they can sign into the service. That password can be changed only on the same PS3 that activated the account, or through a validated email confirmation, Sony said.
Sony has also created a new chief information officer position to oversee security, in the wake of the massive data breach that exposed 77 million account holders' personal information. A "Welcome Back" program offering free content to all subscribers, and a free 30-day subscription to PlayStation Plus members, will also be implemented.
Hirai outlined details of Sony's recovery plan today at a news conference in Japan.
Sony executive Kaz Hirai apologized to gamers around the world today in a press event in the wake of the 10-day outage of the hacked PlayStation Network.
Hirai and other Sony executives and apologized to users immediately upon coming out on stage at a press conference in Tokyo. As they did so, they bowed in front of the press. The executives described what happened with a “highly sophisticated attack” against the PSN.
Hackers attacked the PlayStation Network on April 19, forcing the Japanese company to bring down the network, which has more than 77 million registered users. The outage has been one of the most humbling corporate events for Sony. The security gaffe, which happened at the same time that Amazon’s web services data center crashed, could shake the faith that consumers have in the internet cloud, where corporations say they will protect their personal data.
“This criminal act against our network had a significant impact not only on our consumers, but our entire industry,” Hirai said. “These illegal attacks obviously highlight the widespread problem with cyber-security. We take the security of our consumers’ information very seriously and are committed to helping our consumers protect their personal data. In addition, the organization has worked around the clock to bring these services back online, and are doing so only after we had verified increased levels of security across our networks.”
Speaking through a translator, Hirai said, “We advised customers to be vigilant” about the possibly stolen credit card numbers. He said that Sony is cooperating with authorities in a criminal investigation in pursuit of the hackers. Hirai said that as many as 10 million credit cards numbers may have been stolen. That number appears to be all of the credit card numbers that Sony has, since many of the 77 million registered users log into the network and play online for free.
The apology press event took place in Japan at 2 pm Sunday Tokyo time, or 10 pm on Saturday evening Pacific time. Hirai, (pictured above), is representative corporate executive officer and executive deputy president of Sony as well as head of the game business. He was joined by Shinji Hasejima, senior vice president and chief information officer at Sony, and Shiro Kambe, senior vice president of corporate communications at Sony.
Sony said it wasn’t sure whether hackers had stolen users’ credit card numbers, which were encrypted. But users have begun to complain about false charges on their credit card accounts. Other corporations can’t be smug as they watch Sony and Amazon recover, since no one can be certain that their networks are secure from hackers or technical glitches.
The PlayStation Network is Sony’s all-important hub of the digital age. It enables PlayStation 3 and PlayStation Portable users to go online and find more content to download to their machines, from movies to TV shows. The PSN also hosts Sony’s Home virtual world and its console-based Sony Online Entertainment games: Free Realms and DC Universe Online. Also, the service allows users to store their saved single player games and engage in multiplayer combat online. The Qriosity service, which also went down, gives users access to online movies and music. In other words, the PSN and Qriosity are central to Sony’s survival in the digital age.
Back in March, Sony chief executive Howard Stringer concentrated more power in the hands of Hirai, who once headed the U.S. PlayStation business for Sony. Hirai is now the No. 2 executive next to Stringer and may be in line to succeed him when Stringer steps down around 2013.
The problem for Sony is that this story, like the outage itself, has refused to die. We’ve run 15 stories about it so far, mainly because users seem hungry for more information because there just hasn’t been enough good information coming from the official source. Sony has been good about putting updates on the PlayStation blog, but it hasn’t been fast enough.
For instance, Sony said the attack occurred on April 19, forcing Sony to shut the services down. Sony notified users on April 22 that an “external intrusion” led to an outage. It hired forensic computer investigators to figure out what happened. After their initial inquiry, Sony announced on April 26 that personal user data for all 77 million of the PSN and Qriosity services had been compromised and their credit card numbers have been stolen. On April 26, Sony began informing all affected users of the possible credit-card data breach.
Hirai said that hackers penetrated a web application server and made a tool to give themselves illegal access to the database. They were able to access a database with data that included credit card numbers.
Hirai said the company is moving servers from San Diego, Calif., to a more advanced data center with better security. It is also installing more security systems with automated software management and enhanced levels of data encryption and better ability to detect data intrusions. The company is adding more firewalls too and it is adding a new chief information security officer, reporting to Hasejima. PS 3 will have a new system software update requiring users to change their user names and passwords. The password can only be changed on the same PS 3 on which the account was created or via validated email.
To deter identity theft, the company is asking customers to be vigilant and check their credit card statements. Customers can check their purchase history on the PSN via Sony’s customer support system. Sony said it will not ask for credit card numbers and warned users to beware of possible phishing schemes sent via email. Sony will consider the cost of reissue of credit cards if consumers wish to do so. It will provide a complimentary offering for identity theft protection services in each affected country. The company will roll out a program with a selection of premium services for consumers. This “welcome back” content will have free downloads, and 30 days of free PlayStation Plus network service. Normally, Sony charges extra for the Plus service, while membership in the PlayStation Network is free.
The company is planning on restoring the services as soon as it can, with some services starting this week. Hirai said that Sony’s network services are key to its strategy and it will continue to strengthen them and learn from this incident. The attack targeted Sony’s data center in San Diego, Calif.
Separate from the attack that brought down the PSN, Hirai said that Sony’s sites had been subjected to attacks from Anonymous, the hacktivist group that targeted Sony during its litigation with “jailbreaking” hacker George “Geohot” Hotz. During these attacks, hackers dug out personal information on Sony executives and published it on the web. Sony is cooperating with authorities on those attacks as well.
In closing, Hirai bowed again and apologized again. Responding to press questions, Hirai said that he had received questions about the matter from members of Congress in the U.S. and would answer the questions. In about a week’s time, the service is expected to restart. Hirai said he had not received reports that actual damages had been incurred related to the credit card exposure.
Notes handed out before a Sony press conference today (timed so conveniently at 1am EDT in the US, and noon on the Sunday of Golden Week in Japan) reveal that Sony plans to offer free downloads of unidentified "content," 30 days of free PlayStation Plus access to new and existing members, and 30 days of free Qriocity service. The paper also says that PSN service will be restored "soon."
Two days ago, a PlayStation Blog Q&A post mentioned that the company was considering a "goodwill gesture" to PSN users (and sure, why not Qriocity users too) put out by the two-week outage. The company will likely have to provide much more dramatic gestures to appease all the government organizations who have taken interest in the case (and, you know, that enormous data leak).
Sony "Executive Deputy President" Kaz Hirai has yet to take the stage, so there may be more details forthcoming, like the exact date of PSN reactivation. Follow along after the break for pseudo-liveblog coverage.
Sony guesses that hackers got into the network through an "application server," through which they were then able to get into the database servers and grab data.
Hirai estimates about 10 million PSN users with active credit cards tied to PSN. Security measures will include moving to a new physical data center, more firewalls, and a new "Chief Security Officer." And, of course, a PS3 firmware update. Passwords will only be changeable through the same PS3 that the account was started on, or through a verified email address. Hirai asks you to "be vigilant" and check your credit card statements. Good advice!
Sony will not contact you under any circumstances asking for your credit card number or other personal info. So if someone claiming to be Tom Sony asks for your credit card verification code, you're getting scammed!
Sony is "considering" covering the costs of credit card replacement for affected users. The company is instituting a "welcome back" program including free downloads of selected content, 30 days of free PlayStation Plus for new and existing users, and -- for Qriocity members -- 30 days of free services.
Hirai just called out Anonymous as having attacked Sony by releasing personal info about executives and family members. Sony will cooperate with law enforcement and other organizations to secure data and ensure safety. The fact that this note came right after the Anonymous thing suggests that they'll work with law enforcement to track those kids down too.
Nikkei just asked if all 10 million credit cards got out. Hirai said "we can't rule out the possibility" that credit card info was compromised, but Sony hasn't received any reports of illicit card info usage. Another exec on stage said that all Sony knew on April 20 was that there may have been an intrusion.
Hirai just reminded us that it's not really 78 million people whose info got stolen, because some of those 78 million accounts are duplicate accounts for the same person. He refrained from providing details of the investigation, because the case has just started. But he did say that "not to his knowledge" has Sony been working with law enforcement agencies out of the US, but they have brought "inquiries" to Sony.
The vulnerability in the web server was a vulnerability known about that particular type of server, one of the execs on stage said.
Hirai defended the long response time by saying that Sony took the PSN down as soon as something was shown to be wrong, but analysis took time. "Once we became aware of the situation, we moved promptly to warn customers."
A reporter asked what the purpose of the "intrusion" was. Hirai: "For the past month and a half, we've experienced attacks on various Sony systems. We have yet to identify a direct relationship with a group." Speculation about the objective: "We are not in a position to say one way or the other." That same reporter asked if passwords were encrypted. I believe (translation not being perfect) that Hirai said they were not.
If customers wish to cancel their services, Sony will cooperate in good faith.
by 
