Initial Disclosure Date: Sep 10, 2012

On September 3, NullCrew, a hacktivist group, tweeted under the handle name of OfficialNull (@OfficialNull), “SONY Hacked.” More specifically, the actor stated on pastebin that their target was www.sonymobile.com. The group also explained about its motivation for this hacking. “Sony, we are dearly dissapointed in your security. This is just one of eight sony servers that we hve control of. Maybe, just maybe considering IP addresses are avaliable. Maybe, just maybe it's the fact that not even your customers can trust you. Or maybe, just maybe the fact that you can not do anything correct technologically.” The posted data dump includes 441 usernames with additional email addresses, 24 usernames with encrypted passwords, and three administration data sets. The leaked personally identifiable information (PII) seems to belong to its Chinese and Taiwanese customers.

On September 6, Sony reported that a Chinese company outsourced by Sony Mobile Communications had found their servers were cyber-attacked, basically admitting the claim by NullCrew. “Servers owned by Sony Mobile do not have any trace to indicate unauthorized access,” explained the Sony Public Relations office. They argued that the leaked information does not include credit card numbers and bank accounts. Since that server has information on other customers, Sony is now investigating if the data has been stolen. As soon as the company uncovers the entire incident, they will decide on which steps they should take.

NullCrew is a new hacktivist group and has become active over the last couple of months. Some cybersecurity experts point out that the group is linked to Anonymous. Their victims include the Cambridge University, Yale University, Cambodian Army, and the Cambodian airline PMT Air. Anonymous described their relations in its interview with Infosecurity. “They work with us, but have their own agenda.” NullCrew launches cyber-attacks for political motives just like Anonymous, including their support of Julian Assange and also for fun or lulz. If NullCrew truly hacked eight servers as they posted on pastebin, they may add data dump for the rest of the breached PII.

Sources:
Asahi Shimbun, “Sony Mobile de kokyaku joho ryushutsu Anonymous kanren ga seimei [A hacktivist group linked to Anonymous declared that they had leaked information on Sony Mobile customers],” September 6, 2012,
http://www.asahi.com/business/update/0906/TKY201209060377.html
Charlie Osborne, “NullCrew pillages Sony servers?,” ZENet, September 3, 2012,
http://www.zdnet.com/nullcrew-pillages-sony-servers-7000003621/
InfoSecurity, “Sony hacked by NullCrew; Anonymous attacks MI5 and MI6,”
http://www.infosecurity-magazine.com/view/27948/sony-hacked-by-nullcrew-anonymous-attacks-mi5-and-mi6/
Jiji, “Sony kogaisha no kokyaku joho ryushutsu = Chudai no 400 ninbun --- Hakka shudan ga seimei [A Sony affiliated company found that information for 400 Chinese and Taiwanese customers had been leaked, according to a hacker group],” September 6, 2012,
http://www.jiji.com/jc/c?g=soc_30&k=2012090600380
Kyodo News, “Sony ni saiba kogeki 400 ninbun joho ryushutsu [Cyber-attacks on Sony led to the leakage of 400 customers’ information],” September 6, 2012,
http://www.nikkansports.com/general/news/f-gn-tp1-20120906-1012479.html
Sankei Shimbun, “Sony mata saiba kogeki ukeru Kojin joho yaku 400 ken ryushutsu no kanousei mo [Sony was cyber-attacked again --- PII belonging to about 400 people seems to have been leaked],” September 6, 2012,
http://sankei.jp.msn.com/economy/news/120906/biz12090612030007-n1.htm
Seiko Suzuki, “Hakka shudan, Sony ni taisuru hakkingu wo kogen [A hacktivist group declared they had hacked Sony,” ITMedia, September 4, 2012,
http://www.itmedia.co.jp/enterprise/articles/1209/04/news026.html
Yomiuri Shimbun, “Anonymous shinnyu? Sony kokyaku 400 nin no joho ryushutsu [Breach by Anonymous? Leakage of Information on 400 Sony customers],” September 6, 2012,
http://www.yomiuri.co.jp/atmoney/news/20120906-OYT1T01158.htm

• * Each company name, an organization name, and a brand name are a trade name of each company and each organization, or a registered trademark.