Sony Says PSN Credit Cards Encrypted, Not Personal Data

How did they know? What did they know? When did they know? You won’t get satisfactory answers to those questions, but you may gain insight into others with a new question and answer blog series about the PlayStation Network fiasco, launched last night by Sony spokesperson Patrick Seybold.

While Sony has yet to apologize to customers–that apology may be coming once the network’s back, or it may just be that Sony’s been advised to lawyer up–the company does seem to be taking its customers more seriously with these suddenly lengthier, less evasive missives.

(More on TIME.com: First PlayStation Network Class Action Lawsuit Filed)

In the Q&A, Seybold says that all PlayStation Network personal data–including the data compromised in the breach–was “protected,” and that “access was restricted both physically and through the perimeter and security of the network.” But while all credit card data was encrypted (and Sony maintains it has “no evidence that credit card data was taken”), the personal data table was a “separate data set” and “was not encrypted.”

While the company won’t rule out the possibility that intruder(s) snatched credit card data, Seybold notes that the CVC or CSC number (your card’s three or four digit security code) could not have been taken because neither the PSN nor Qriocity services asked for it (and thus never stored it).

If you haven’t yet received an email from Sony about the matter, the company says it’s been working to process “all 77 million registered accounts,” and that all registered accounts should receive the email notice by today, April 28th (for the record, I have yet to receive anything from Sony in either a customer or media-related capacity).

(More on TIME.com: Analyst: PlayStation Network Fiasco Will Be Costly, Change Industry Forever)

Another interesting wrinkle: In addition to rebuilding their PSN and Qriocity server farms, Sony says it’s “moving [its] network infrastructure and data center to a new, more secure location.” That helps explain the time delay a bit–there’s a physical rebuilding process underway that parallels the virtual one.

And it sounds like the perps will be tracked to the ends of the earth: The company says it’s working to find whoever’s responsible for the “criminal” breach “no matter where in the world they might be located.”

When will service be restored? Sadly not by this weekend. Sony says it “[expects] to have some services up and running within a week from yesterday,” which means we should see at least partly resuscitated PSN and Qriocity services by next Wednesday, May 4th.

Related Topics: breach, FAQ, outage, playstation, playstation network, ps3, PSN, qriocity, Gaming & Culture, Sony
  • http://imc01.wordpress.com imc01

    Matt Peckham, thanks for the update, one thing I would like to point out is that Mr Seybold needs to get his facts right before attempting to lie to the public.
    When you first set up a Playstation Network account and make a purchase IT DOES ASK YOU FOR YOUR CVC NUMBER FROM YOUR CARD. I have had to enter this info myself. Any chance you can see what he has to say about that now?

  • pks29733steel

    Sony started off years ago as a manufacturer of ‘Rice Cookers’. They should had stayed in that bussiness!!

  • cyberprivateer

    2011 is looking like a year of biblical plagues for Japan. While it’s an American pastime to dog pile on guys when they’re down, I remind the attorneys who are racing to get in line for the Tort Feed Trough that one corporate executive turned the tables years ago. Just before Oracle was to file for their IPO, a Canadian customer sued for fraud and even talked R.I.C.O. grounds. Larry had no choice but to disclose this suit in his red herring document, and it galled him. So he really did something about it. He countersued and won, eventually owing all the assets of the firm that sued him. Then he sued the Canadian law firm that represented the plaintiff for malpractice. And won. And drove them out of business. He then went after the California law correspondent law firm for malpractice. You get the idea. I think Sony should call Larry Ellison and get some independent advice. In fact, Prime Minister Kan might also call the real-life Tony Stark (Ellison, not the Tesla Motors wannabe) for a bit of a pep talk. In fact, I gave him this advice in my blog this morning: http://www.themorgandoctrine.com/2011/04/dear-japan-call-larry-ellison.html

blog comments powered by Disqus