The 2014 Sony Pictures Hack: Wiper Malware, Leaks and a Film Pulled

On 24 November 2014, employees at Sony Pictures Entertainment turned on their computers and saw a red skeleton image and a message from a group calling itself the Guardians of Peace. Over the following weeks, the company lost access to much of its network, and unreleased films, internal emails and personal data of employees were published online. It remains one of the best-known examples of a destructive cyberattack on a private company.

What happened

The attackers had been inside the network for some time before the day the message appeared. They copied large amounts of data, and then used malware that erased data from computers and servers, a type often called a wiper. Many systems had to be taken offline, and for a period the company reportedly had to go back to pen, paper and fax machines for basic tasks.

In the days that followed, copies of several unreleased Sony films appeared online, along with employee records including salary information and personal details, and large volumes of internal email. The leaked emails caused embarrassment for senior executives and contained remarks about actors and producers that quickly became news stories. Co-chair Amy Pascal stepped down in early 2015.

The Interview

The attack happened shortly before the planned release of The Interview, a comedy about a plot to assassinate North Korea's leader. In mid-December the attackers issued threats against cinemas that showed the film. Several theatre chains said they would not show it, and Sony cancelled the planned wide release, before later releasing it online and in a limited number of independent cinemas. The decision drew criticism from public figures, including the US president, who said Sony had made a mistake.

Who was blamed

On 19 December 2014, the FBI stated that the US government attributed the attack to North Korea, citing technical similarities to previous malware and infrastructure linked to the country. North Korea denied responsibility. Some security researchers questioned the strength of the public evidence at the time, and debate continued. In later years, US prosecutors charged an individual described as a North Korean programmer in connection with this and other attacks. It is accurate to say that the US government attributes the attack to North Korea, while the public evidence has been argued over.

What made it so damaging

• Long dwell time. The attackers were inside for a long time and had the chance to map systems and gather data.
• Flat access. Once inside, they reached a very large number of machines.
• Destructive capability. The wiper malware destroyed data, which meant that recovery depended on backups and rebuilding systems.
• Sensitive files in the open. Reports described spreadsheets and documents containing credentials and personal information stored without protection.

The cost

Sony later reported charges related to the attack, including investigation and remediation costs, and it settled a class action brought by former employees whose personal data had been leaked. The wider industry took note. Boards that had treated cyber incidents as an IT matter began to see them as a threat to the business, with reputational and legal consequences.

Backups are your last line of defence

A wiper turns a security incident into a recovery problem. If the only copy of your data sits on the same systems as the attacker, it can be destroyed along with them. The common principle is to keep several copies, on different types of storage, with at least one that cannot be reached with the same login credentials as the main systems.

Effects on the wider security industry

Before 2014, most public breaches involved stolen data or stolen money. The Sony Pictures incident showed that an attacker's aim could be pure destruction and public humiliation. Governments responded in different ways: the US imposed new sanctions on North Korean entities in early 2015, and the incident was cited when policymakers discussed information sharing between companies and agencies.

For companies, the main change was in the planning. Incident response plans that assumed a quiet recovery had to deal with stolen emails appearing in the press, staff without working computers and journalists asking questions. The better plans covered how to communicate with employees when email is down, who speaks for the company and how to rebuild systems in a sensible order.

A small business needs a lighter version of the same thinking: a list of the important accounts, the contact details of whoever manages your website and a clear idea of what you would tell customers if your site disappeared for a day.

The practical lesson for site owners

Keep regular backups of your site files and databases, store at least one copy away from the server and test a restore before you need it. Do not keep passwords, spreadsheets of customer data or database exports in folders that are reachable from the web. Limit administrator rights so a single stolen account cannot touch everything.

Our hosting plans run on Plesk, which includes backup tools; see our knowledge base for how to schedule and test them, and our security overview for the wider picture.