Users of the Sony Playstation Qryocity service now have a new way to occupy their time during the outage of the popular gaming platform: changing their passwords and security questions across the web. Sony has released a statement warning users of the Playstation Qryocity service that the week-long outage is actually related to a security breach. Hackers seem to have been able to access the Qryocity user database, exposing such data as: "name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID…"
Since many people use the same password and login information across many web services, this could lead to widespread hacking of user accounts across the web. If that's not bad enough, the company is also saying that other information may have also been accessed including purchase histories, billing addresses, and answers to security questions.
This is worrisome, given that many web sites use the same security questions to help users recover forgotten passwords. In addition, Sony is saying that while they can't confirm that credit card information was accessed, "out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained."
Sony is warning its users about targeted phishing attacks (cybercriminals may impersonate Sony in emails asking users to "confirm" credit card, password, or other sensitive pieces of information) and the other account security issues mentioned above. Sony is suggesting that users change their passwords on other sites where the same password was used. Security questions and answers should also be changed. Sony is further informing consumers that they can receive one free credit report per year from the US Government to help monitor fraud.
That may be useful down the road after damage has been done, but a better step would be signing its users up for an identity theft protection service. The best services actually monitor the web's black markets for unauthorized uses of user personal information, as well as monitoring your credit report daily for unusual activity, and providing assistance in case of fraud. We hope Sony will step up, but users of Qryocity, and anyone else concerned about their identity, might want to start thinking about it now.