Sony has started notifying the personnel affected by the recent data breaches as we're now just getting an idea of how much data a ransomware group accessed.
According to a new report by Bleeping Computer, the company has informed current and former employees of the Sony Interactive Entertainment division after an unauthorized actor accessed the company's systems. There are 6,781 individuals affected by the recent security breach as recorded by the Office of the Maine Attorney General.
The unauthorized access was due to a vulnerability in MOVEit Transfer, a file-management transfer software being used by Sony and many other companies. CL0P, a ransomware group, claimed responsibility for the data breach. The group reportedly used an exploit in MOvEit's vendor Progress Software, allowing the hackers to steal data from the databases.
"Sony has been investigating recent public claims of a security incident at Sony. We are working with third-party forensics experts and have identified activity on a single server located in Japan used for internal testing for the Entertainment, Technology, and Services (ET&S) business," a spokesperson for Sony Corporation said to IGN. "Sony has taken this server offline while the investigation is ongoing. There is currently no indication that customer or business partner data was stored on the affected server or that any other Sony systems were affected. There has been no adverse impact on Sony operations."
In a letter sent out to affected individuals, Sony revealed that two data breaches happened. The first one occurred on May 28 before Progress Software notified companies using MOVEit of the breach. The company was reportedly notified on May 31, three full days after the attack.
There was a second data breach on June 2 where hackers initiated unauthorized downloads. As a result, Sony turned the platform online until the vulnerability was fixed. Sony has launched an investigation into the security breach with external cybersecurity experts and notified law enforcement.
Sony is offering affected individuals Equifax credit monitoring and identity restoration services. Finally, individuals that's proven to be impacted by the security breach will receive a unique voucher code which is valid until the end of February 2024.
Video games and tech companies are a frequent target of cyber-attacks. One of the most notable security breaches happened to Rockstar. Just last a year, a group of individuals stole gameplay footage of Grand Theft Auto 6 along with source codes for previous titles. The hacker has since been identified and has been prosecuted in the United Kingdom. Rockstar said that GTA6 will not be delayed as a result of the security breach.