Skip to main content

The Globe and Mail

Security employees laid off before data breach: lawsuit

Chinese sales staff talk with customers behind a row of Sony computers for sale at a computer market in Beijing in this June 29, 2009 file photo.

DAVID GRAY/REUTERS

Sony Corp. laid off employees in a unit responsible for network security two weeks before a massive data breach, according to a lawsuit filed this week.

Sony also spent lavishly on security to protect its own corporate information, while failing to do the same for its customers' data, the proposed class action lawsuit alleges.

Sony has been under fire since April, after hackers accessed personal information on 77 million PlayStation Network and Qriocity accounts, 90 per cent of which are users in North America or Europe.

Story continues below advertisement

The company said at the time credit card information may have been stolen, sparking lawsuits and casting a shadow over its plans to combine content and hardware products via online services.

Sony later revealed hackers had stolen data from 25 million users of a separate system, its Sony Online Entertainment PC games network, in a breach discovered on May 2.

In a lawsuit filed in a San Diego federal court on Monday, a proposed class of Sony customers says the company knew it was at increased risk of attack because it had experienced prior, smaller breaches.

A Sony representative did not immediately respond to a request for comment on Thursday.

Additionally, Sony laid off "a substantial percentage" of its Sony Online Entertainment workforce, including "a number" of employees in its Network Operations Centre, says the lawsuit, which cites a confidential witness.

The Network Operations Centre is responsible for preparing for, and responding to, security breaches, the lawsuit said.

Sony installed appropriate firewalls and other security measures to protect its own sensitive data, but chose not to do the same for customer data, the lawsuit said.

Story continues below advertisement

The security breach is one of the latest cyber attacks against high-profile firms, including defence contractor Lockheed Martin and Google Inc.

The case in U.S. District Court, Southern District of California is Felix Cortorreal, Jacques Daoud Jr. and Jimmy Cortorreal, on Behalf of Themselves and All Others Similarly Situated v. Sony Corporation Inc. et al, 11-1369.

Report an error
As of December 20, 2017, we have temporarily removed commenting from our articles as we switch to a new provider. We are behind schedule, but we are still working hard to bring you a new commenting system as soon as possible. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.