Sony sony.com Sony data breach 2011: what happened and what to do
In June 2011, a SQL injection flaw on sonypictures.com exposed tens of thousands of accounts. Have I Been Pwned counts 37,103 accounts with names, emails, passwords, phone numbers, dates of birth and addresses. The passwords were stored in plain text.
View all 13,115 breaches- Breach date
- 2 Jun 2011
- Made public
- 2 Jun 2011
- Affected
- 37,103
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Sony had several security incidents in 2011. This page covers the one on sonypictures.com, which Have I Been Pwned (HIBP) dates to June 2, 2011 and added to its database in December 2013.
What happened
A hacking group said it broke into Sony Pictures' website using a basic SQL injection attack. That's a flaw where a site passes user input straight into a database query, so an attacker can make the database hand over records. The group said the stolen passwords weren't encrypted, and HIBP's entry confirms they were stored in plain text. At the time, Sony only said it was looking into the claims.
The group claimed it had reached more than a million accounts. HIBP's copy of the data holds 37,103 accounts, and that is the figure this page uses. Press coverage from June 2011 quotes the larger claim, so you may see both numbers online.
What was exposed
According to HIBP, the data includes:
- Names and usernames
- Email addresses
- Passwords, stored in plain text
- Phone numbers
- Physical addresses
- Dates of birth
- Genders
Plain text passwords are the worst part. Anyone holding the file could read every password without cracking anything, and people reuse passwords. A password from a 2011 Sony account could still unlock an email or shopping account today if you never changed it.
What criminals can do with it
An email, a full name, a home address and a date of birth together are what a scammer needs to write a convincing message. Expect phishing that uses your real name and address, and calls or texts to the phone number on file. The date of birth is the more lasting problem: unlike a password, you can't change it, and it helps with identity checks at banks and phone carriers.
The breach is old, so the data has been copied and recombined for years. If you had a Sony Pictures account around 2011, assume your details are out there.
Sony's response
Sony's public statement in June 2011 said it was looking into the claims. HIBP lists the breach as verified, and nothing in the sources describes a settlement for the Sony Pictures accounts.
Why it still matters
Old breaches feed new attacks. Criminals run old email and password pairs against current logins, a technique called credential stuffing. If you used the same password on Sony Pictures and anywhere else, those other accounts are the real risk, not the Sony one.
Serus can't remove breach data, because it sits in files already copied around. What it does is watch breach databases and the dark web for your email and other details, and alert you so you can act quickly. The steps below are the ones that matter most.
What to do if you were in it
- 1
Change any password you used on Sony Pictures
If you reused it anywhere, change it on those accounts first, starting with email and banking. Use a different password for each site, ideally from a password manager.
- 2
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email, bank and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that uses your real details
Your name, address and phone number were exposed together. Be wary of messages and calls that quote them, and never act on a link in an unexpected message. Go to the company's site yourself.
- 4
Watch for identity theft
Your date of birth was exposed. Consider a free credit freeze at Equifax, Experian and TransUnion, and check your credit reports for accounts you don't recognize.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Was I affected by the Sony Pictures breach?
Search your email on Have I Been Pwned, or run a free Serus scan. HIBP lists 37,103 accounts from this breach, and accounts that existed on sonypictures.com in 2011 are the ones in scope.
What was exposed in the Sony breach?
Names, usernames, email addresses, plain text passwords, phone numbers, physical addresses, dates of birth and genders, according to HIBP.
Is there a settlement for this breach?
None of the sources used for this page mention a settlement for the 2011 Sony Pictures account exposure.
Should I change my password?
Yes, if you ever reused the Sony Pictures password. Change it everywhere you used it and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
