While it's been game over for more than 70 million Sony PlayStation network users for almost a week now and with no definitive return date, customers found out yesterday that the Sony gaming system's trove of user data has been hacked.
A blog post by Patrick Seybold, PlayStation senior director of corporate communications and social media, reads in part: "We believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. ... While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility." The post goes on to warn customers to beware of unsolicited communications asking for personal information and "encourage[s] you to remain vigilant, to review your account statements and to monitor your credit reports."
Gamers and media had been speculating about those possibilities since the outage began, but it was the first official acknowledgement from Sony. Mr. Seybold had been posting updates on the blog, as well as Facebook and Twitter, almost daily since April 20, but until today the posts have been vague, acknowledging there is a problem and that Sony is working to resolve it.
"It's taken them six days to point out that your personal data has been hacked into? That's far too long. And to just to say 'sorry, sorry' and 'be patient' all along? All kinds of things could have happened with that data by now," said Mike Mulvihill, president at PR and marketing agency CRT/Tanaka.
Mr. Seybold responded to similar criticism in a follow-up post late Tuesday meant to "clarify" the fact that while Sony knew there was an "intrusion" last week, it did not know customer data was compromised until yesterday. Nonetheless, some blog commenters continue to criticize PlayStation for not warning them of the possibility.
The bigger question is, what long-term damage could the outage and data breach mean for the PlayStation brand?
That probably depends on the severity of the breach. Gamers are definitely ticked off, but most acknowledge that they are a fervent crowd. Microsoft's Xbox Live service survived gamers' furor during an 11-day outage at launch during holiday 2007, although that was due to network overcrowding and not a hacking issue.
David Cole, president of DFC Intelligence, said, "Gamers being gamers, they are more likely to be mad. People don't really appreciate delays in the short term. However, not fixing things has the potential to be much worse. ... Now having confirmed identity theft, I think it is a much more serious issue than just a shutdown. Identity theft is scary."
And it is the severity of the information leak is the heart of the issue. If the hack was simply a "because we could" snub at Sony and the data goes unused, it will be forgiven more quickly than if widespread fraud attempts begin. The PlayStation network is free, but has a paid "plus" service, where credit-card data would have been provided.
"People really still don't know if their credit-card information is secure and that's very worrisome," said Sebastian Moss, managing editor for online blog PlayStation LifeStyle. "If credit-card information is compromised, the long-term damage will be far more than with just a service outage."
PlayStation does deserve some applause, said Steve Beck, managing partner at management consulting firm CG42, for quickly taking down the network and keeping it down until they figured out what was going on.
"What this will come down to as the story unfolds is how serious it is and what did [Sony] do to prevent this on the front end," Mr. Beck said. "Whether Xbox or Nintendo stand to gain share because of this is way too early to tell. However, relative to Sony's push to drive more online services, it certainly causes a bump in that road."
Mr. Cole added, "I think people will be asking questions of not just Sony, but all online operators about these issues. There will need to be substantial damage control to assure consumers this will not happen again."
And PlayStation may even be seen as a victim in all of this, said crisis communications expert Gerald Baron.
"Apparently there is a hacker organization that has taken a strong dislike to Sony and the presumption of everyone in the know on these things was that this organization attacked the network. Apparently this is what they do," he said. "But the real gift ... [they are] giving Sony is the gift of being perceived as the victim."