Shortly after the Playstation Network announcement warning users of possible idedntity and credit card fraud, Connecticut Senator, Richard Blumenthal, expressed his anger in a letter to SCEA president Jack Tretton.
Claiming the PSN response to their customers was extremely delayed, Senator Blumenthal writes to Tretton that “When a data breach occurs, it is essential that customers be immediately notified about whether and to what extent their personal and financial information has been compromised.” In the letter, Senator Blumenthal explains that even though the security “breach occurred nearly a week ago, Sony has not notified customers of the intrusion” until now.
Patrick Seybold, Sr. Director, Corporate Communications and Social Media of Sony, replied to many complaints of the PSN delay. In his blog, he posts the following:
I wanted to take this opportunity to clarify a point and answer one of the most frequently asked questions today.
There’s a difference in timing between when we identified there was an intrusion and when we learned of consumers’ data being compromised. We learned there was an intrusion April 19th and subsequently shut the services down. We then brought in outside experts to help us learn how the intrusion occurred and to conduct an investigation to determine the nature and scope of the incident. It was necessary to conduct several days of forensic analysis, and it took our experts until yesterday to understand the scope of the breach. We then shared that information with our consumers and announced it publicly this afternoon.
For those who were looking there’s also an FAQ with some more frequently asked questions
Thank you for your continued patience and support.
With the personal information of their customers now at risk, I think it is safe to say that the Playstation Network has failed to uphold the security that should have been provided to PSN users. Although they only learned the full extent of the situation on Wednesday, they neglected to keep their customers informed throughout the investigation.
I have posted the full letter from Senator Blumenthal to Jack Tretton below.
Dear Mr. Tretton:
I am writing regarding a recent data breach of Sony’s PlayStation Network service. I am troubled by the failure of Sony to immediately notify affected customers of the breach and to extend adequate financial data security protections.It has been reported that on April 20, 2011, Sony’s PlayStation Network suffered an “external intrusion” and was subsequently disabled. News reports estimate that 50 million to 75 million consumers – many of them children – access the PlayStation Network for video and entertainment. I understand that the PlayStation Network allows users to store credit card information online to facilitate the purchasing of content such as games and movies through the PlayStation Network. A breach of such a widely used service immediately raises concerns of data privacy, identity theft, and other misuse of sensitive personal and financial data, such as names, email addresses, and credit and debit card information.
When a data breach occurs, it is essential that customers be immediately notified about whether and to what extent their personal and financial information has been compromised. Additionally, PlayStation Network users should be provided with financial data security services, including free access to credit reporting services, for two years, the costs of which should be borne by Sony. Affected individuals should also be provided with sufficient insurance to protect them from the possible financial consequences of identity theft.
I am concerned that PlayStation Network users’ personal and financial information may have been inappropriately accessed by a third party. Compounding this concern is the troubling lack of notification from Sony about the nature of the data breach. Although the breach occurred nearly a week ago, Sony has not notified customers of the intrusion, or provided information that is vital to allowing individuals to protect themselves from identity theft, such as informing users whether their personal or financial information may have been compromised. Nor has Sony specified how it intends to protect these consumers.
PlayStation Network users deserve more complete information on the data breach, as well as the assurance that their personal and financial information will be securely maintained. I appreciate your prompt response on this important issue.
United States Senate