If a hacker issues a statement saying they have broken into your website and stolen 1 million plain text passwords, as well as compromising a whole lot of other information, what would you do?
And if you’re the same global corporation that was previously hacked and had 1 million other customer records compromised, what would you do the second time it happens?
Of course, you’d issue a statement saying that you were investigating the claims. That should do the trick, shouldn’t it?
Sony (Sony Pictures, this time) doesn’t appear to care about your security at all. Stored in plain text was a whole lot of useful personal information: name, address, telephone number, password……and all accessed by means of a basic SQL injection attack.
If you’re a corporation or run a website that stores personal data, you need to check it out for vulnerabilities (it’s called penetration testing – and it’s neither complex nor expensive, but it is essential – a bit like checking your front door to make sure that it really is locked and won’t fall over if pushed).
If you’re an individual who had a Sony Pictures account, you need to:
- Go change your password on any other online account that has the same password;
- Watch out for phishing attacks – targeted right at you, with very relevant information – something like guidance on what to do if you are worried that your personal details may have been stolen;
- Watch out for vishing attacks – phishing attacks by VoIP – telephone callers asking you for critical missing information, like date of birth or mother’s maiden name – maybe claiming to call from your bank…….
- Keep any eye on your credit record – investigate suspicious stuff asap (and, remember, your bank will probably want to sell you insurance against identify theft, even though this may be designed not to pay out under most reasonably imaginable circumstances);
- Avoid Sony in future!!
