Sony Cyberattack Exposed Thousands of Employees’ Personal Data

Sony has warned nearly 6,800 former and current employees of its games division that their personal information may have been compromised in a ransomware attack earlier this year.

The breach happened May 28 and was carried out by the ransomware group known as Cl0p, Bleeping Computer reported. The group reportedly exploited a “zero-day vulnerability” in the file transfer platform MOVEit Transfer, a software that Sony Interactive Entertainment employs. Progress Software, the company behind the exploited software, informed the game company of the breach on May 31.

“[Sony Interactive Entertainment] discovered the unauthorized downloads, immediately took the platform offline and remediated the vulnerability,” the notice to employees, obtained by Bleeding Computer, reads. “An investigation was then launched with the assistance from external cybersecurity experts.”

Sony says that the breach did not affect any of its other systems. Still, a total of 6,791 people were affected. These individuals were contacted and given instructions on next steps, according to the notice.

The news comes just a week after another hacker group claimed to have compromised “Sony systems.”

Sony told The Messenger that there was “no indication that customer or business partner data was stored on the affected server.”