Sony’s MOVEit Breach Hit Worker Families, Not Players

Sony Interactive Entertainment told 6,791 people in the United States that a May 2023 file-transfer hack took their names and Social Security numbers. The letters went to current and former staff and to family members, not to PlayStation account holders.

A second incident, on a Japan test server used by a different Sony unit, produced a narrower line: no customer or partner files on that box, and no hit to operations.

The Letters Named Former Staff and Family Members

The sample letter on file with Massachusetts regulators is not written to a gamer. It opens by saying SIE believes the reader is a former employee, or a family member of a current or former employee, and that some of their personal information was caught in an event tied to an IT vendor, Progress Software.

We are writing to you as we believe you are a former employee of Sony Interactive Entertainment (“SIE”) or are a family member of a current or former employee of SIE. We want to provide you with information about a cybersecurity event related to one of our IT vendors, Progress Software, that involved some of your personal information. This event was limited to Progress Software’s MOVEit Transfer platform and did not impact any of our other systems.

Sony Interactive Entertainment, October 3, 2023 notice

That October 3, 2023 notice to families is the public artifact of who sat in the blast radius. Current workers were in the pool too, but the posted template is aimed at people who may have left SIE, or who never worked there at all.

Maine’s breach portal records the same event as an external hack that acquired a name or other personal identifier together with a Social Security number. The filing counts 6,791 people in the Maine filing, including four Maine residents, with consumer notices dated October 3, 2023.

Each person received a letter that listed the data types SIE had matched to them. Those fields are blacked out on the sample, so the public record is the SSN pairing, not a full inventory of every file.

What Data Left Sony’s MOVEit Box

The path was not a PlayStation login cluster. It was MOVEit Transfer, a managed file-transfer product SIE used, as thousands of other organizations did, to move files. The letter says an unauthorized actor used a newly found flaw on May 28, 2023, to download some SIE files stored on that platform, three days before Progress told customers the product was open.

Progress later told investors its MOVEit technical support team received the first customer call on May 28 in the evening, Eastern Time, flagging unusual activity. The company said it reached MOVEit Transfer and MOVEit Cloud customers on May 30, took MOVEit Cloud down for investigation that day, and released patches on May 31, 2023, the same day it restored the cloud service. It also told investors that MOVEit Transfer and MOVEit Cloud accounted for less than 4 percent of annual gross revenue.

SIE says it found the unauthorized downloads on June 2, 2023, took the platform offline, fixed the flaw, hired outside cyber experts, and notified law enforcement. The Maine filing puts the intrusion window at May 28 through May 30, 2023, and the discovery date at June 2.

THE MOVEIT WEEKEND AT SIE

1. May 27, 2023: CISA later said the CL0P group began exploiting the then-unknown SQL injection flaw in internet-facing MOVEit Transfer apps.
2. May 28, 2023: An unauthorized actor downloads some SIE files from Sony’s MOVEit platform; Progress logs its first support call that evening.
3. May 30, 2023: Progress says it warned MOVEit customers and took MOVEit Cloud down; Maine records SIE’s intrusion window as still open through this date.
4. May 31, 2023: Progress announces the flaw, now tracked as CVE-2023-34362, and ships patches.
5. June 2, 2023: SIE finds the downloads and takes its MOVEit platform offline; CISA adds the flaw to its Known Exploited Vulnerabilities catalog.

The letter stresses that the event stayed on that one product and did not touch SIE’s other systems. That sentence is doing a lot of work. It is how the company separates a human-resources file box from the PlayStation network that still carries the scar of 2011.

No Customer Files on the Japan Test Server

In late September 2023, while SIE was still months from mailing the MOVEit letters, extortion accounts began fighting over a different Sony theft. Ransomed.vc claimed it had compromised “all of Sony systems” and put data and access up for sale, citing about 260 GB. A second actor, MajorNelson, called that crew a scam and dumped a 2.4 GB archive that unpacked to 3.14 GB, saying it held credentials, certificates, Creators’ Cloud material, SonarQube files, and a license-generating emulator.

A Sony spokesperson later described a much smaller box.

Sony has been investigating recent public claims of a security incident at Sony. We are working with third-party forensics experts and have identified activity on a single server located in Japan used for internal testing for the Entertainment, Technology and Services (ET&S) business. Sony has taken this server offline while the investigation is ongoing. There is currently no indication that customer or business partner data was stored on the affected server or that any other Sony systems were affected. There has been no adverse impact on Sony’s operations.

Sony spokesperson, statement on the Japan server

ET&S is the electronics arm, TVs and cameras and the rest, not PlayStation. The customer-safe wording belongs to that server. It does not rewrite the Maine SSN count on SIE’s MOVEit box.

TWO SONY INCIDENTS, TWO PAYLOADS

The two jobs landed in the same four-month window and fed a single public impression that “Sony got hacked.” One of them produced regulated notices and credit monitoring. The other produced a statement about a test machine.

Clop’s Memorial Day Weekend Caught Thousands of Firms

SIE was late to the mailing, not unique on the victim list. CISA and the FBI described a CL0P campaign against MOVEit Transfer that began May 27, 2023, using CVE-2023-34362 to drop a web shell later named LEMURLOOT and pull data from the databases behind those file-transfer apps. The same crew had already run zero-day campaigns against Accellion file-transfer appliances and Fortra’s GoAnywhere product.

Clop added Sony Group to its leak site in late June 2023. SIE’s letter, mailed in October, still said the company was not aware of publication or misuse of the personal information named in those letters. Listing a company as a victim and publishing a given worker’s file are not the same act, and SIE did not treat them as one.

MOVEIT’S 2023 SCALE

• Start of exploitation: CISA dates CL0P’s MOVEit activity to May 27, 2023, a U.S. holiday weekend.
• SIE’s share: 6,791 people, with Social Security numbers in the Maine record.
• Running tally: Emsisoft’s September 26, 2023 count stood at 2,095 organizations and 62,054,613 people.
• Federal clock: CISA added CVE-2023-34362 to its known-exploited list on June 2, 2023, the day SIE says it found the downloads.

The Emsisoft tally of MOVEit victims is a tracker built from notices, filings, and leak-site posts, not a Sony document. On that list, SIE is a mid-size node. Maximus, state motor vehicle offices, and payroll vendors dumped far larger populations. Sony’s 6,791 still includes people whose only tie to the company was a relative’s job.

Four Months Sat Between the Download and the Notice

SIE found the downloads on June 2, 2023. The notices are dated October 3, 2023, 123 days later, and 128 days after the May 28 download. The letter says matching files to people was slow, and that SIE wanted the details to be accurate before it wrote.

U.S. state breach laws often run on shorter clocks once a company knows whose data left. SIE’s public explanation is the review, not a claim that it lacked the headcount. Clop had already put Sony Group on a leak site in late June, which means the first public naming did not come from SIE.

That gap is the part that tracks Sony’s older employee-file problem. In 2014, Sony Pictures workers watched payroll and Social Security files spill in a studio breach. In 2011, Sony said personal details from about 77 million PlayStation Network accounts had been compromised. The 2023 MOVEit notice is smaller, and it is not a console outage. It is the same class of record, sitting on a vendor box that HR and payroll teams use because it is supposed to be the careful way to send a file.

By the time the letters landed, the people who still worked at SIE had months to hear rumors. The former staff and the family members on the Massachusetts template had no badge, no internal memo, and no reason to watch a ransomware leak site for their own names.

Equifax Coverage Came With a Hard Enrollment Date

SIE offered free Equifax Complete Premier credit monitoring and identity restoration. Maine’s filing describes the offer as 24 months of Equifax ID WatchDog or Complete Premier. The letter is stricter on the calendar: a unique code, and a hard stop. Recipients had to enroll by February 29, 2024, to receive the services.

Those are two different clocks. Coverage, once started, was set for 24 months. The voucher itself died on leap day 2024 if nobody used it.

WHAT THE EQUIFAX OFFER INCLUDED

• Three-bureau monitoring: Email alerts on key changes, with Experian and TransUnion feeds taking several days to start.
• Daily Equifax file: Ongoing access to the Equifax credit report and a one-bureau VantageScore.
• WebScan alerts: Notices if a Social Security number, card number, or other listed identifier showed up on suspected trading sites.
• Fraud tools: Automatic fraud alerts, inquiry alerts, an Equifax credit-report lock, identity restoration help, and lost-wallet assistance.

The letter also told people to watch their own statements, and it pointed them to annual free credit reports and to fraud alerts or security freezes at Equifax, Experian, and TransUnion. SIE set up a call center at 1-855-457-8896, weekdays from 9:00 a.m. to 6:00 p.m. Eastern.

A monitoring product can flag a new account. It cannot pull a Social Security number back out of a file that left a MOVEit box in May. The Japan server statement let Sony say customers were not on that machine. The Maine filing is the record of who was on the other one: 6,791 people, some of them family, with names tied to Social Security numbers, and a voucher that had to be activated by February 29, 2024.

Frequently Asked Questions

What identity theft insurance did Sony offer after the MOVEit breach?

The Equifax Complete Premier packet attached to SIE’s letter included up to $1,000,000 of identity theft insurance for certain out-of-pocket losses, underwritten by American Bankers Insurance Company of Florida. Enrollment was limited to people over age 18 who already had a credit file, so a minor named only as a family member could not activate that product in their own name.

Did Sony’s 2023 MOVEit incident affect PlayStation Network logins?

SIE’s notice said the MOVEit event did not impact any of its other systems, which is the company’s wording for keeping this incident off the PlayStation network. Sony’s large consumer account theft remains the 2011 PlayStation Network case, when it said personal details from about 77 million accounts had been compromised. The 2023 Japan test-server incident, at ET&S, is a third bucket: Sony said it found no customer or business partner data on that server.

When did U.S. agencies have to patch the MOVEit flaw after CISA listed it?

CISA added CVE-2023-34362 to its Known Exploited Vulnerabilities catalog on June 2, 2023, and the catalog entry set a June 23, 2023 due date for federal civilian agencies to apply the vendor’s updates. That federal deadline bound U.S. agencies; SIE is not a federal agency, and its own letter says it took the platform offline the day it found the downloads, June 2.

How could people reach Sony about the 2023 MOVEit notice?

SIE published a dedicated call center at 1-855-457-8896, staffed Monday through Friday from 9:00 a.m. to 6:00 p.m. Eastern Time, for questions about the event and about the Equifax enrollment. The Massachusetts sample letter is signed Sony Interactive Entertainment and lists a Cheektowaga, New York mailing point for the notice packet.