Information “possibly obtained”:
– Billing address
– Purchase history
– PlayStation Network/Qriocity password security question responses
– all above data for any dependent accounts (your children’s sub-accounts)

 
Although there is no evidence at this time that payment card information has been accessed, Sony are “unable to rule out this possibility” and are advising their customers accordingly.
 
What does this mean for you? Well if you’re the type of person who tends to reuse your password across multiple web sites today’s the day to get out there and start changing that password and breaking that habit. Criminals now have your email address and common password, they may also have the answers to your security questions, which also tend to get reused.
 
It is never a good idea to use the same password across multiple web sites, so try to have a unique one for every site you use. While this may sound complex and impossible to remember there is simple way to acheive this. Create a complex password using upper and lower case letters, numbers and special characters such as $%&!. Devise a way to differentiate your password for each site you use, for example putting the first and last letters of the web site name at the beginning and end of your initial complex password, making it unique yet easy to remember
 
As for those security or password reset questions, this is also one of the most common ways to break into an account. If you are asked to provide answers to “Security questions” consider whether the answers are really secure. Secure means that you are the only person who can answer the question. If the possibility exists to create your own questions, use it. If you are obliged to answer more standard questions such as “First school”or “First pet” remember the answer doesn’t have to be the truth, it only has to be something you can remember.
 
Aside from this, given the nature of the warning from Sony keep aeather eye on your bank statements for any unauthorised activity.
 

My notification mail from Hilton HHonors

• Pay careful attention to emails your receive in the coming months, perhaps years.
• Never surrender personal information to a website without having used one of your own bookmarks to get there or typing it yourself (i.e. don’t follow links in mails).
• Before giving out personal details, ensure that the connection is secured with SSL. You can see this is the case if the address starts with “https://“. If it’s not encrypted they don’t deserve your data.
• Read the privacy agreement carefully before you hand over any details. If there is anything you are unhappy with reconsider your decision to sign up.
• To better insure yourself against this kind of eventuality in future consider using unique addresses for each service, I wrote an article on how to easily achieve this here.

 
And for all of the companies out there that process, store or transmit personal data belonging to other people… ENCRYPT IT, no excuses, no get out clause. This is only the beginning and you owe your customers a duty of care.
 

used with permission from Anonymous9000 under creative commons

  
On the eve of an EU summit set to discuss the ongoing military action in Libya, the European nuclear program and the debt crisis, key systems have been shut down and warning issued to staff as a result of what a spokesperson called “a serious cyber attack“.
  
Details on the nature, extent and consequences of the attack are currently very few but the timing and targeting are highly reminiscent of the attack against the French finance ministry two weeks ago which reportedly targeted information relating to the G20 summit.
  
A spokesperson for the European Commission stated that the commission is often “targeted” by cyber attacks, but that the extent of this one was far larger than those more regular events. Staff have been asked to change their passwords, external access to email and to the Commission’s intranet was temporarily suspended, in order to “prevent the disclosure of unauthorised information”. EUObserver reports having seen an internal mail that warned all staff
 

“We have found evidence that both the commission and EEAS [European External Action Service] are the subject of an ongoing widespread cyber attack.“

  
According to the AFP report, EU spokesperson Antony Gravili blamed the attack on malware, “rather than any attempt to unearth secret documents relating to summit issues”. Given the nature of contemporary attacks on commercial and government institutions, in reality it’s very difficult to draw the line between those two eventualities. Malware is simply one of the tools in the criminal and international espionage bag of tricks and making such a clear distinction before a thorough investigation has been completed may be counter-productive to say the least.
  
International cyber-espionage and criminal theft of information for commercial advantage has been going on for several years now but only really caught the public imagination with the furore surrounding the Aurora attacks in 2009/2010. Since that time, the mood for public disclosure of these attacks has rapidly changed and may contribute somewhat to the impression that they are increasing in frequency.
  
Nevertheless, Aurora, Night Dragon, Stuxnet and the attacks on the G20 and EU summits graphically illustrate the new reality. Cyberespionage, just like cybercrime is more simple to perpetrate, more difficult to spot and  carries much less risk than the more traditional methods. This is the new front line.
 

Image used under Creative Commons from Noah Sussman's Flickr photostream

“Dear Customer,
 

Email Security Message
 

 
We are emailing all our customers to let you know that a company that handles part of our marketing commmunications has had a security breach. Unfortunately this has meant that some customer names and email addresses may have been compromised.“

 
The email does not offer any details of which subcontracted marketing agency was breached, or how that breach occurred, which is a shame as it seems a reasonable assumption that the agency in question would also be holding customer details on behalf of other companies.
 
Play.com go on to say:
 

“We take privacy and security very seriously and ensure all sensitive customer data is protected.  Please be assured this issue has occurred outside of Play.com and no other personal customer information has been involved.”

 
The fact that it is a third party that has suffered the breach will not protect Play.com from falling foul of the Data Protection Act, the Data Controller (Play.com) remains responsible for the security of data handled by subcontracted third parties (known as Data Processors).
 
I called the Information Commissioner’s Office this morning to check if they had been notified of this data breach, they were unable to locate any recent notification on behalf of Play.com. According to the lady I spoke to there, play.com are only required to notify the Information Commissioner of a breach “if they consider it serious”. Play.com certainly considered it serious enough to notify their customers, so we can only hope the official notification is making its way through the correct channels.
 
Unfortunately the email from play.com to their customers does not contain any contact information for worried customers, only the advice “Please do be vigilant with your email and personal information when using the internet“, which seems a little ironic under the circumstances.

Online discussion forums seem to already show evidence that the stolen email adresses are being used for spamming.
 
If you have received one of these notification emails and have any concerns, you can make a direct complaint to the Information Commissioner’s Office by downloading this form and following the instructions on this page over at the ICO.