> series: anatomy_of_a_breach —— part: 028 —— target: sony_playstation_network —— accounts: 77,000,000 —— downtime: 23_days<span class="cursor-blink">_</span>_
On 20 April 2011, Sony took the PlayStation Network (PSN) offline after detecting unauthorised activity on its network. Six days later, Sony confirmed what gamers worldwide feared: the personal data of approximately 77 million PSN accounts had been compromised. The stolen data included names, addresses, email addresses, dates of birth, PSN login credentials, and — for an undisclosed subset of users — credit card numbers and expiry dates.
The PlayStation Network remained offline for 23 days — an eternity for the gaming community and a commercial catastrophe for Sony. The total cost of the breach was estimated at $171 million. The UK's Information Commissioner's Office fined Sony £250,000, finding that the attack 'could have been prevented' if Sony had implemented known security measures. The ICO specifically noted that Sony's software was not up to date, that known vulnerabilities had not been patched, and that passwords were not adequately protected — failures that a routine penetration test would have identified.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe ICO's enforcement notice was unusually specific about the security failures that enabled the breach. The findings read like a penetration test report — and they describe vulnerabilities that our testing identifies routinely.
| ICO Finding | What It Means |
|---|---|
| Software was not up to date | Known vulnerabilities in the Apache web server software running PSN were not patched. Vulnerability scanning identifies missing patches, and Cyber Essentials mandates a 14-day critical patching window under Danzell. |
| Known vulnerabilities not addressed | The specific vulnerabilities exploited by the attackers were publicly known and patches were available. This is the definition of a preventable breach — and the exact scenario our infrastructure penetration testing is designed to identify. |
| Passwords not adequately protected | User passwords were not hashed using an appropriate algorithm. Weak password storage means a database breach exposes credentials in a usable form. Our password cracking assessments evaluate password storage security. |
| No firewall between web servers and database | The database containing 77 million user records was accessible from the compromised web server without adequate network controls. Infrastructure testing validates network segmentation between application tiers. |
The Sony PSN breach is the case study for preventable breaches. Every vulnerability the ICO identified — unpatched software, known vulnerabilities, weak password storage, absent segmentation — is a standard finding in penetration testing. Had Sony commissioned a web application test and infrastructure assessment of the PSN platform, these vulnerabilities would have been found and remediated before the attackers found them.
For any organisation operating a platform with millions of users, the Sony breach establishes the minimum: regular penetration testing, vulnerability scanning, prompt patching (now mandated by Cyber Essentials Danzell), strong password hashing, and network segmentation between application tiers. SOC in a Box provides the continuous monitoring that detects intrusions before they reach the database. And UK Cyber Defence provides the incident response capability for when a breach is discovered.
Our <a href="/penetration-testing">penetration testing</a> finds the unpatched software, the weak password hashing, and the missing segmentation before an attacker does — and before the ICO tells you it was preventable.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call