Sony has begun contacting thousands of current and former staff impacted by recent data breaches after a ransomware group claimed last week it had accessed the company's systems.
As reported by Bleeping Computer, Sony has now informed employees of its Sony Interactive Entertainment (SIE) division whose data was exposed. The outlet wrote that the notification was sent out to about 6,800 individuals impacted by the breach. Sony disclosed in the notification to victims that the breach was due to a vulnerability in the MOVEit Transfer, a file-managed transfer software employees at Sony and other companies use.
Sony did not immediately respond to IGN's request for comment.
CL0P is the ransomware group that claimed responsibility for the data breach. X users FalconFeed posted on the platform in June that on May 28, CL0P used an exploit in MOvEit's vendor Progress Software, allowing it to steal data from the MOVEit databases.
In the letter Sony sent out to victims (as uploaded by Bleeping Computer), Sony admitted that two data breaches occurred: the first happened on May 28 before Progress Software notified Sony and other companies using MOVEit of the breach. Sony would then discover a second data breach on June 2, when it detected someone initiating unauthorized downloads, which resulted in the company turning the platform offline until it fixed the vulnerability.
Alongside disclosure of the data breach, Sony also informed victims of the attack that they are being offered Equifax credit monitoring and identity restoration services. Each person impacted was given a unique voucher code, valid until the end of February 2024.
The data breach is one of the biggest to hit the PlayStation maker in recent years, with the most infamous occurring in 2011 when PlayStation 3 and PlayStation Portable networks suffered a severe outage lasting nearly a month, with 77 million accounts compromised as a result of the hack.
Taylor is a Reporter at IGN. You can follow her on Twitter @TayNixster.
