Sony may face global legal action after security breach

SONY could face legal action across the globe after it delayed disclosing a security breach of its popular PlayStation Network, infuriating gamers and sending the firm’s shares down nearly 5% yesterday.

Sony shut down the network on April 19 after discovering the breach, one of the biggest online data infiltrations ever. But it was not until Tuesday that the company said the system had been hacked and that users’ data could have been stolen.

In the US, several members of Congress seized on the breach, in which hackers stole names, addresses and, possibly, credit card details from 77 million users. One law firm filed a lawsuit in California on behalf of consumers.

“Gamers are angry that Sony’s CEO hasn’t come out to explain the situation and investors are disappointed over the company’s corporate governance,” said Michael Wang, manager of overseas funds at Prudential Financials, which owns shares in Sony.

Sony’s PlayStation Network, which produces an estimated $500 million in annual revenues, provides access to online games, movies and TV shows.

Gamers may consider moving to Microsoft’s Xbox platform following the breach. Security experts said Sony would need to account for this potential loss of business — as well as damage to its brand — when it tallies up the cost. Other costs include notifying customers of the attack and bringing in experts to cleanse its network.

Experts claim the data theft could ultimately cost Sony more than $1.5 billion (€1.01bn), or an average of $20 for each of the 77 million customers whose data was potentially compromised.

Sony say the delay in notifying the public was needed to conduct a forensic investigation. The company has struggled for years to control the activities of hackers, who make up a portion of PlayStation’s fanbase.

Earlier this month, a group called Anonymous conducted attacks on Sony websites and online services, motivated by revenge for the company’s attempts to clamp down on hacking.

In the US, attorneys general, who act as consumer advocates, had begun investigating the matter or reviewing it with staff in several states.

Britain’s Information Commissioner’s Office said it had contacted Sony and was investigating whether it violated laws that require it to safeguard personal information. The investigation would depend in part on whether Sony stored user information in Britain.