The 2011 PlayStation Network Breach and the Weeks-Long Outage

In April 2011, millions of gamers found that they could not log in to the PlayStation Network. What began as an unexplained outage turned into one of the largest consumer data breaches of its time, and a lesson in how badly the handling of an incident can damage trust. The network stayed offline for around three weeks while Sony rebuilt its systems.

What happened

The PlayStation Network went down on 20 April 2011. Sony initially gave little detail, saying only that it was investigating a problem. On 26 April it confirmed that an unauthorised person had accessed account information and that the service would remain offline while it was rebuilt and its security improved. The company said that personal data from around 77 million accounts could have been exposed, including names, addresses, email addresses, dates of birth and login details.

Sony also said it could not rule out that credit card numbers had been obtained, although it stated that the card data was encrypted and that it had no evidence that card numbers had been taken. In early May, Sony disclosed a second incident involving its Sony Online Entertainment service, affecting about 24.6 million further accounts.

The communication problem

Much of the criticism focused on timing. Sony took roughly a week from the outage to tell customers that personal information might have been taken. During that window, users had no idea whether to change passwords elsewhere or watch their bank statements. Lawmakers in the United States and elsewhere wrote to the company asking why it took so long. Senior Sony executives later apologised publicly and the company launched a "Welcome Back" programme that offered free games and a period of identity theft protection to affected users.

Technical failures and regulatory action

The UK Information Commissioner's Office investigated and in January 2013 fined Sony Computer Entertainment Europe 250,000 pounds. The regulator said the attack could have been prevented if the software had been up to date, and that the password data was not properly secured.

Several lessons emerged from the investigation:

• Known flaws have to be fixed. Unpatched software on a server is an invitation.
• Data should be protected on its own, not only by the perimeter. If an attacker gets inside, hashed passwords and encrypted fields still protect users.
• Segmentation limits damage. One breached service should not give access to every account.

The cost of rebuilding

The service came back in stages starting in mid-May 2011, with new security measures and a requirement for users to reset their passwords. Sony reported significant costs, including the cost of the outage itself, customer goodwill offers and security improvements. The company also faced class-action lawsuits in several countries.

For a business, the lasting damage is rarely just the cash. Customers who could not play, developers who lost sales and partners who relied on the platform all felt the outage. Rebuilding trust takes longer than rebuilding servers.

Backups and recovery plans

An outage this long also shows why recovery planning matters as much as prevention. A breached system cannot simply be switched back on. It needs to be rebuilt from a known good state, which is only possible if you have clean backups, documented configurations and a tested process. Without these, every hour of downtime becomes guesswork.

Why gamers' data is worth stealing

It is tempting to think that a gaming account holds little of value. The PlayStation Network case showed otherwise. Accounts held real names, home addresses, email addresses and purchase histories, and many users had stored payment details with the service. Email addresses and passwords are particularly valuable because people reuse them: a login stolen from a game service can be tried against email, shopping and banking sites.

For this reason, security advice after the incident focused not only on the PlayStation account itself. Users were encouraged to change the same password anywhere else they had used it, to watch for phishing emails that mentioned the breach, and to check their financial statements. The phishing risk is important for website owners too: after any public breach, criminals send convincing messages posing as the affected company, so your customers need clear guidance on what your real messages will and will not ask for.

If your own site has user accounts, think about what an attacker could do with that data elsewhere, not just on your site. That perspective changes how carefully you treat even a small mailing list or customer login.

The practical lesson for site owners

You may not hold the data of 77 million people, but you may hold the names, emails and passwords of your customers. Keep software patched, store passwords only as strong hashes through a reputable CMS, collect only the data you need and decide ahead of time how you will tell customers if something goes wrong. Act quickly and be specific when you do.

Make sure you have a recent backup stored away from the server and know how to restore it. Our security overview explains the protections on our plans, and our knowledge base shows how to set up and test backups in Plesk.