If you use Sony’s PSN or SOE services there are a number of risks that you’re now exposed to.
Depending on the level of access gained by the hackers and the information they were able to glean you could be exposed to some or all of the following:
1. Credit Card Fraud
Issue: Some credit card details have been taken by the hackers. Sony claim this information was encrypted and that the details from the SOE attack date back to 2007.
Risk: Your current credit card details were included in those that were stolen and the hackers have been able to decrypt and use them or sell them on.
Precautions: Keep an eye on your credit card statements and notify your card issuer of any suspicious or unauthorised transactions. Alternatively, if you’re very worried you could cancel your cards and get new ones. It’s also possibly worth keeping an eye on your financial history and credit rating via someone like Experian to make sure you haven’t been the victim of further fraud.
2. Identity Theft
Issue: It appears that an awful lot of data was harvested in the attacks. Alongside the credit card details which may have been compromised, Sony have admitted that users names, addresses, dates of birth and other potentially useful ID information has been compromised.
Risk: The criminals behind this kind of attack are after exactly this type of information which they can use themselves or sell on to other professional ID thieves. You could become the victim of partial or full identity theft. This could put you at risk of significant financial loss, reputational damage and could cost you a considerable amount of money, merely to correct the damage.
Precautions: Fairly similar to credit card fraud – you need to keep an eye on all your credit, bank and any other financial transactions. In addition, it’s a good idea to check your history on a regular basis and possibly even take out ID theft insurance – but check with your provider that you’re covered retrospectively, otherwise you could be paying out for nothing.
3. Online Compromise
Issue: The hackers have gained valuable information on millions of users, including usernames and passwords. Many users use the same account and password credentials across many different online and offline services. This can range from using the same username with multiple online services such as Hotmail and Gmail to using the same password for Facebook and you online bank account.
Risk: If you reuse the same credentials across multiple platforms and one of them is compromised then they all are – it is only a matter of time before your other services are accessed. This can lead to a whole host of problems, from someone posting questionable “status updates” on Facebook or Twitter, to them attempting to access your online banking, or even manipulating your friends into giving out their personal details.
Precautions: Change your passwords! Don’t reuse the same passwords on multiple platforms, particularly social and financial systems. And don’t always trust that your friend is the only person using their social networking account – it may have been compromised.
4. Social Engineering
Issue: The sheer number of people who have had some or all of their Sony account details compromised makes it very attractive to criminals attempting different approaches. Some will use the simple ID theft and credit card fraud approaches. Others will attempt to gain access to other online resources. Yet another set may attempt to “socially engineer” the individuals concerned – which essentially means to “con” them into giving out other details by making them believe they are being contacted by a legitimate company (including Sony themselves!).
Risk: You might take a call or receive a letter, email or social media contact informing you that you’re the victim of Sony’s hack or some other related issue. If this happens you will be asked to prove you are the person concerned, and so you will be asked for other “security” details. All of this information can be used to further compromise you financially, steal your identity or access other online resources.
Precautions: Don’t take off the cuff calls or other contacts at face value. Be suspicious. Tell the caller that you will call them back, get their name and office details and then call the main switchboard number of the company they claim to be from. Do the same for emails and letters. Remember, no legitimate organisation will ask you for your full password or PIN number for an account.
Hopefully, nobody will ultimately fall victim to the criminals who masterminded the attack on Sony. Unfortunately that’s pretty unlikely. All anybody can do now is to defend themselves to the best of their ability and take precautions to limit the damage that can be inflicted upon them.
This kind of attack, where major corporates are targeted, is likely to occur more and more as service provider’s offer ever increasing online services to an ever growing online community.
What we need to do is attempt to defend ourselves and improve the security of the services provided online, designing them with security in mind from the start rather than implementing security as an afterthought.