PSN down: the hack that exposed 77 million accounts in 2011

On April 20, 2011, millions of PS3 owners opened the online menu and found the same message: “The PlayStation Network is undergoing maintenance.” A few hours of downtime was normal. But one day passed, then two, then three. The “maintenance” never ended. Six days later, Sony admitted what had actually happened: the PlayStation Network had been breached and the data of 77 million users was compromised. It was one of the largest data breaches in history up to that point — and the company only said so after a week.

How the attack happened

The attack took place between April 17 and 19, 2011. The intruders exploited vulnerabilities in Sony's web application server — Apache servers running outdated versions, without the security patches available at the time. The network architecture followed the classic three-tier model (web server, application server and database), and the attackers managed to cross those tiers until they reached the database holding user information.

The investigation by the ICO (the UK's data protection authority) concluded that Sony did not keep its infrastructure updated and used insufficient security configurations. The LulzSec group, in a later statement, claimed to have accessed part of Sony Online Entertainment's data via SQL injection — one of the oldest and most avoidable techniques in offensive security: improperly validated data inputs let an attacker send commands directly to the database.

What was exposed

What data was stolen in the 2011 PSN hack?

Names, addresses, emails, dates of birth, passwords and possibly credit card numbers from 77 million PSN accounts, plus 24.6 million Sony Online Entertainment accounts.

The word "possibly" regarding the cards is itself a sign of failure: Sony didn't have enough visibility to say with certainty what had been accessed. As for the passwords, the ICO concluded they were inadequately protected — weak hashing, with no salt, which left the data vulnerable to dictionary attacks if the files fell into the wrong hands.

In total, combining PSN and Sony Online Entertainment, the incident affected close to 102 million accounts — which made it, at that moment, the largest consumer data breach in history.

Sony took six days to tell anyone

One of the most criticized aspects of the incident wasn't the attack itself — breaches happen — but Sony's response. The company took six days after detecting the intrusion to notify the 77 million affected users. In that interval, personal and possibly financial data was circulating without the victims knowing.

Sony only made the public announcement on April 26, three days after taking the PSN offline. The delay was justified internally as necessary for the investigation, but regulators and users didn't accept the explanation. The US Congress summoned company executives to give evidence.

That delay is particularly dangerous when you consider the risk of credential stuffing: attackers who obtain a password database test the same credentials on other services. Every hour without a warning is more time for that to happen at scale.

Did Anonymous hack the PSN?

Initial suspicion fell on the Anonymous collective. Shortly before the attack, the group had declared war on Sony over the lawsuit filed against George Hotz (aka "GeoHot"), the developer who had jailbroken the PS3 — and whom Sony sued for it. The context was one of open, public conflict.

Anonymous, however, denied involvement in the breach in a direct statement: "For once we didn't do it." Sony, in turn, said it had found a file on its own servers with the text "Anonymous" and the slogan "We Are Legion", suggesting someone claiming to be part of the group was involved — or wanted it to look that way.

Whoever was behind the main attack was never identified. Nobody was formally charged over the PSN case. LulzSec claimed a separate intrusion into Sony's SOE system, but not the main breach.

The consequences for Sony and for users

The total estimated cost to Sony was US$171 million. The UK's ICO fined the company £250,000, concluding that "the breach was entirely preventable if Sony had kept the software up to date." In the United States, a US$15 million class-action settlement was reached in 2014.

For users, the compensation included two free games, 30 days of PlayStation Plus and a year of identity theft protection service. The PSN came back online partially on May 14, 2011 — 23 days after the blackout.

The shock accelerated a complete overhaul of Sony's security infrastructure, including the creation of a dedicated cybersecurity team and periodic independent audits.

What this incident still teaches

The PSN hack wasn't sophisticated — it was opportunistic. Outdated software, inadequate password protection and no active monitoring were the ingredients. That combination of classic failures is still responsible for a huge share of the breaches reported today.

For the ordinary user, a few direct practices come out of this episode:

• Unique passwords per service. When a database leaks, attackers' first move is to test the credentials on other services. Use a password manager and never reuse combinations.
• Two-factor authentication. Even if your password leaks, the second factor blocks automated mass access.
• Monitor your data. Have I Been Pwned indexes known breaches and tells you if your email shows up in any of them — including the PSN one.

For anyone administering systems, the ICO's report is blunt: keeping patches current isn't an optional best practice, it's a legal responsibility. And monitoring needs to be good enough to know exactly what was accessed — not merely that something was accessed.

If you want to understand how attackers combine leaked data with manipulation techniques to escalate attacks, the post on social engineering explains why the human link remains the most exploited one even when the initial technique is pure system intrusion.