The company has just confirmed the Sony data breach from May. However, another breach is also waiting for its approval from the last month, as well. It would appear that 2023 is not a good year for Sony’s cybersecurity services.
Picture this: a tech giant, known for pushing the boundaries of possibility, finds itself entangled in not just one, but two cybersecurity breaches within a single year. Let’s take a closer look at what is happening at Sony.
The first Sony data breach of 2023 confirmed
Sony Interactive Entertainment (Sony) has recently confirmed a significant data breach in which the personal information of current and former employees and their family members was exposed. This breach affected approximately 6,800 individuals.
The breach occurred due to the exploitation of a zero-day vulnerability in the MOVEit Transfer platform, specifically CVE-2023-34362, a critical-severity SQL injection flaw capable of remote code execution. The Clop ransomware gang, a group notorious for large-scale cyberattacks on organizations worldwide, carried out the breach. Despite the intrusion occurring on May 28, 2023, Sony only became aware of the vulnerability three days later when notified by Progress Software, the MOVEit platform vendor. Sony promptly took action by shutting down the affected platform, remediating the vulnerability, launching an investigation with external cybersecurity experts, and notifying law enforcement agencies.
Importantly, Sony has emphasized that the breach was limited to the compromised software platform and did not impact any of its other systems. However, sensitive information belonging to thousands of individuals in the United States was exposed, with Sony meticulously determining the nature of the compromised data and providing affected individuals with customized notifications.
In response to the breach, Sony is offering credit monitoring and identity restoration services through Equifax to those affected, accessible via unique codes until February 29, 2024. This breach marks one of the two cyber incidents Sony has faced in 2023, highlighting the company’s dedication to addressing cybersecurity challenges and protecting its stakeholders’ interests.
The recent Sony data breach
In a surprising twist, Sony faced another potential breach just weeks after the initial incident. Allegations on hacking forums claimed that 3.14 GB of data had been stolen from the company’s systems. Sony responded swiftly by launching an investigation. The leaked dataset included sensitive information related to the SonarQube platform, certificates, Creators Cloud, incident response policies, and more.
CL0P #ransomware group added Sony Group (https://t.co/gWitcpMi4s), a Japanese multinational conglomerate corporation to their victim list. #Japan @SonyGroupGlobal#clop #darkweb #databreach #cyberrisk https://t.co/K61asq3o3E pic.twitter.com/JOnfhSdaPF
— FalconFeeds.io (@FalconFeedsio) June 22, 2023
Sony, however, clarified that this breach was different from the earlier one. It was identified on a single server located in Japan, used for internal testing within the Entertainment, Technology, and Services (ET&S) business. The company promptly took this server offline during the investigation. Thankfully, there was no indication that customer or business partner data was stored on the affected server, and no other Sony systems were impacted. Sony assured its stakeholders that there had been no adverse impact on its operations.
If you want to learn more about the Sony data breach, visit the related article.
Featured image credit: Nikita Kostrykin/Unsplash
