Tue, May 03, 2011 | 14:59 BST

SOE: 12,700 old CC numbers, 10,700 DD records breached

The hits just keep coming for Sony. Following all-too-soon after the news that Sony Online Entertainment servers had been taken offline, the company has now confirmed that it “may” have lost 12,700 customer credit card numbers.

According to the hardware giant, approximately 24.6 million accounts may have been breached, including “approximately 12,700 non-US credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain.”

SOE insists, according to GI.biz, that out of the 12,700 non-US cards, only 900 remain active today and are still usable, however.

To help you breathe slightly more easily, the information stolen was from an “outdated database from 2007″. Of the full number, 4,300 of the cards are allegedly from Japan, while the remainder are from Europe.

SOE said in an email to customers this morning that: “There is no evidence that our main credit card database was compromised. It is in a completely separate and secured environment.”

Despite Sony’s repeated claims that the PSN servers and SOE servers are not part of the same network, the theft has been tied directly to the recent PlayStation Network and Qriocity attacks, which saw customer information compromised on either April 16 or 17.

Sony confirmed over the weekend that PSN will start to come back online this week.

The full press release is below.

Tokyo, May 3, 2011 – Sony Corporation and Sony Computer Entertainment announced today that their ongoing investigation of illegal intrusions into Sony Online Entertainment LLC (SOE, the company) systems revealed yesterday morning (May 2, Tokyo time) that hackers may have stolen SOE customer information on April 16th and 17th, 2011 (PDT). SOE is based in San Diego, California, U.S.A.

This information, which was discovered by engineers and security consultants reviewing SOE systems, showed that personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007. The information from the outdated database that may have been stolen includes approximately 12,700 non-U.S. credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain.

With the current outage of the PlayStation® Network and Qriocity™ services and the ongoing investigation into the recent attacks, SOE had also undertaken an intensive investigation into its system. Upon discovery of this additional information, the company promptly shut down all servers related to SOE services while continuing to review and upgrade all of its online security systems in the face of these unprecedented cyber-attacks.

On May 1, Sony apologized to its customers for the inconvenience caused by its network services outages. The company is working with the FBI and continuing its own full investigation while working to restore all services.

Sony is making this disclosure as quickly as possible after the discovery of the theft, and the company has posted information on its website and will send e-mails to all consumers whose data may have been stolen.

The personal information of the approximately 24.6 million SOE accounts that was illegally obtained, to the extent it had been provided to SOE, is as follows:
· name
· address
· e-mail address
· birthdate
· gender
· phone number
· login name
· hashed password.

In addition to the information above, the 10,700 direct debit records from accounts in Austria, Germany, Netherlands and Spain, include:
· bank account number
· customer name
· account name
· customer address.

SOE will grant customers 30 days of additional time on their subscriptions, in addition to compensating them one day for each day the system is down. It is also in the process of outlining a “make good” plan for its PlayStation®3 MMOs (DC Universe Online and Free Realms). More information will be released this week.

Additionally, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.

Sony Online Entertainment LLC (SOE) has been a recognized worldwide leader in massively multiplayer online games since 1999. Best known for its blockbuster hits and franchises, including EverQuest®, EverQuest® II, Champions of Norrath®, PlanetSide®, Free Realms®, Clone Wars Adventures™, and DC Universe Online™, SOE creates, develops and provides compelling online entertainment for virtually all platforms, including the PlayStation®3 Computer Entertainment System, Personal Computer, mobile and social networks. SOE is building on its proven legacy and pioneering the future of the interactive entertainment space through creative development and inspired gameplay design for audiences of all ages. To learn more, visit www.soe.com.

For more information and update about the SOE services, please visit www.soe.com/securityupdate.

58 comments

Older Comments

#51

OlderGamer
03/05/11, 6:06 pm

Jesus Tea, what did I do now? Lemme read it and get caught up. Man the whole world that don’t see eye to eye with you is screwed ain’t it? brb, reading.

#52

frostquake
03/05/11, 6:21 pm

Back on Topic..LOL…LA Times..is this Old or New?

“Such a broad breach of consumer information is rare, because most companies take precautions to silo customer information, separating contact information from credit card data, for example, so that only parts of any customer’s profile can be accessed from a single attack.”

http://latimesblogs.latimes.com/entertainmentnewsbuzz/2011/04/sony-admits-playstation-network-hacked-user-information-compromised-.html

#53

OlderGamer
03/05/11, 6:31 pm

Ok I read through 5 pages of posts. For what?

All I saw was one member of the site getting harrased.Poeple think so much of you Tea that when one of them tries to be you, they do so by being beligerant, foul mouthed, obnoxious, and start aiming personal attacks at other members.

That post was just one in a flury of posts between you and Michael. But when you left the site(for one of your breaks), someone else created a fake account/handle and tried to pretend to be you. It was rude and uncalled for. But like I said taking just that post and isolating it is like taking the thread out of context.

At that point Michael had had enough. You read him bitching at me for NOT posting the IPS right? I never posted anyones IPs, never would.

And just for clearity, Tea did you just say above that I was corrupt because I play xbox360? I mean really? Thats pretty funny man. Better watch out for those Nintendo gamers, I hear them guys are bat shit crazy! They will mess ya up! Don’t look into their eyes!

#54

DGOJG
03/05/11, 6:32 pm

Right I’m seriously confused now. There has been two hacks yes? Or is this just a delayed response from SOE? Some care to explain if I should be panicing?

#55

Gekidami
03/05/11, 6:33 pm

^ No, one hack, but Sony didnt think it affected SOE till recently.

#56

DGOJG
03/05/11, 6:35 pm

@55 Thanks for clearing that up! Doubt they’d attack student accounts anyway