10th Anniversary of the Great PlayStation Network Outage

[Mavrick]

Hard to believe it's really been 10 years since this happened.

On April 20, 2011, the PlayStation Network went down.

It didn't seem like a big deal at first. After all, outages on various gaming networks are semi-common to this day, and the PlayStation Network of 2011 was not exactly known for reliability. The timing was unfortunate, coming right on the heels of anticipated PS3 releases like Portal 2 and SOCOM 4: US Navy SEALs, but frustrated gamers could no doubt find something else to do, get a good night's sleep, and give those games' online functionality another shot the next day.

Unfortunately, the next day Sony gave its first real indication that this was not a normal outage, while still managing to grossly understate the problem.

"While we are investigating the cause of the Network outage, we wanted to alert you that it may be a full day or two before we're able to get the service completely back up and running," it said.

"A full day or two" came and went without Sony restoring service or explaining what had happened. After five days, the company finally confirmed the service had been taken offline as a result of a security breach, with the personal info of more than 77 million registered PlayStation Network and Qriocity users stolen as a result of "an illegal and unauthorized intrusion."

The PlayStation Network would be down entirely for 24 days. Beginning May 15, Sony gradually restored the service over months, with some regions like Japan having some functionality offline for as long as 76 days.

While it was an unprecedented stretch of downtime (and lapse of security) for a major gaming network, it was not entirely unanticipated. Indeed, just a few weeks prior, hacker group Anonymous had warned Sony that it had planned a series of attacks against the company as retribution for its legal pursuit of hackers who cracked the PS3's anti-piracy measures in 2010.

While Anonymous denied involvement in the attack, Sony pointed a finger its way when executives were made to testify before the US House of Representatives. In a letter to Congress, Sony's Kaz Hirai said Anonymous had been executing denial of service attacks on Sony's servers prior to the PSN hack. Additionally, he said that when Sony Online Entertainment suffered a similar breach with nearly 25 million compromised accounts in the wake of the PSN outage, the intruders planted a file on a Sony Online Entertainment server "named 'Anonymous' with the words 'We are Legion.'"

Sony also vowed to "proceed aggressively" against the hackers responsible and bring them to justice. We asked Sony representatives last week to check whether the company was ever successful in that pursuit, but never heard back.

So what was the outcome? Well, there were a lot of class-action lawsuits, and Sony settled them for $15 million. Well, not $15 million actual dollars. $15 million worth of a limited selection of free downloads of PS3 and PSP games and themes that cost Sony basically nothing to hand out. And according to court filings, $2.75 million in actual money paid to the lawyers running the class-action suits.

Sony also paid for 12 months of an identity theft protection service for PSN subscribers, which is an odd half-measure because that's not really how identity theft works. Much of the information stolen could still be used by bad actors to this day. Even outdated information like former addresses provide answers to identity challenge questions from banks or credit reporting agencies, leading to consequences more dire than simply having a credit card number stolen (where the user is typically not liable for fraudulent purchases).

While some were throwing around drastic numbers about what the hack could cost Sony, Wedbush Morgan analyst Michael Pachter offered a depressingly accurate take just days after it happened, saying, "If they offer some free stuff and continue to follow up, this will all be forgotten in a few months."

It's been 10 years now, and while it's a stretch to say the PSN outage has been forgotten, it's difficult to say what kind of long-term influence it's had on the industry, or even Sony itself. While we haven't seen another catastrophic failure on PSN user security, I'm not entirely sure how much of that is due to Sony's efforts. I mean, the company would go five full years from the outage before confirming that it was finally getting around to adding two-step verification to PSN. (Xbox added it in 2013; Nintendo lagged as it often does in anything online-related, rolling out two-step verification for the Nintendo Network in 2017.)

When the PSN hack happened, it was often described in the press as one of the largest data breaches in history. It's much less so now, as security breach tracking site Have I Been Pwned has details of dozens of security breaches involving more than 77 million accounts, including plenty of tech-savvy operations one would hope to be better about security.

Adobe had information for more than 153 million accounts stolen in 2013. LinkedIn lost 164 million email and password combinations in 2016. And as we found out just this month, Facebook patched a security vulnerability in 2019, but not before the personal information of more than 533 million Facebook users around the world had been swiped.

The PSN hack isn't even the biggest data breach in gaming anymore. In 2019, Zynga reported that hackers stole account information belonging to Draw Something and Words With Friends players.

"Cyber attacks are one of the unfortunate realities of doing business today," Zynga said in announcing the breach -- downplaying its failure to secure customer information, neglecting to mention that 173 million users were affected by its failure, and summing up the apparently defeatist attitude towards the subject so many companies have today.

Looking back on the PlayStation Network hack, I can't help think the real lesson companies learned was that compromising the safety and security of millions of your customers is only a truly big deal if it takes your service offline for any length of time.

https://www.gamesindustry.biz/articl...ago-this-month