Sony Pictures Entertainment Data Breach (2014)
The Sony Pictures Entertainment data breach of November 2014 marked a significant cybersecurity incident, where hackers, identifying as the "Guardians of Peace," acquired sensitive employee and company information, including unreleased films. The breach was particularly notable for its connection to the controversial film *The Interview*, which depicted an assassination plot against North Korean leader Kim Jong-un. Following the breach, the hackers issued threats of violence if the film were released, leading to widespread media coverage and public concern.
The FBI initiated an investigation into the breach, with speculation linking it to North Korea due to the film's content, although some cybersecurity experts questioned this connection. The breach resulted in the exposure of personal information for thousands of Sony employees and triggered a class-action lawsuit alleging inadequate data protection. Noteworthy internal emails were leaked during this event, revealing controversial comments by Sony executives about various public figures.
Despite the initial decision by some theaters to withdraw from showing *The Interview*, Sony eventually released the film on Christmas Day, amid heightened scrutiny over the implications of the breach and the threats posed by the hackers. The incident highlighted significant vulnerabilities in corporate cybersecurity and raised discussions regarding the balance between artistic expression and national security.
Sony Pictures Entertainment Data Breach (2014)
In November 2014, Sony Pictures Entertainment revealed a large-scale data breach involving the theft of confidential employee and company information, including versions of several unreleased films. The hackers, operating under the moniker "Guardians of Peace," threatened potentially violent action if the controversial comedy The Interview were released. Investigations indicated that the North Korean government, which was lampooned in The Interview, might have played a role in the breach, though some cybersecurity experts cast doubt on this finding.
Date: On November 24, 2014, Sony revealed that confidential communications, files, and employee data had been stolen and that the company was being blackmailed and threatened with further attacks.
Place: Culver City, California
Key Events
- November 24, 2014-Press releases from Sony Pictures Entertainment reveal that the company has been the target of a cyberattack in which photos, e-mails, employee data, and several unreleased films were copied from Sony's servers by a group calling themselves the Guardians of Peace.
- December 1, 2014-Federal Bureau of Investigation (FBI) launches investigation of the attack.
- December 9, 2014-Guardians of Peace issue a message warning Sony not to screen The Interview, threaten further actions including potential terrorist attacks.
- December 10, 2014-E-mails between Sony cochair Amy Pascal and film producer Scott Rudin are revealed, containing criticisms and inappropriate comments about prominent figures such as President Barack Obama and actor Angelina Jolie.
- December 15, 2014-Former employees file a class-action lawsuit against Sony for failing to protect employee data. Celebrities and industry officials criticize the news media for publishing leaked data.
- December 16, 2014-Guardians of Peace threaten terrorist action against theaters that screen The Interview.
- December 19, 2014-The FBI announces it believes North Korea is responsible for the cyberattack.
- December 30, 2014-Independent research indicates that Sony employees might have been involved in the data breach.
Status
In 2015, Sony Pictures press releases indicated that the attack may have caused as much as $35 million in damages, including the cost of restoring IT and financial systems. Corporate releases revealed that personal information from at least fifteen thousand former and current employees had been compromised in the attack. In June 2015, a federal judge allowed a class-action lawsuit to go forward alleging that Sony failed to provide its employees with adequate data security; however, he dismissed a portion of the suit alleging injury due to Sony's delay in informing employees about the breach.
In-Depth Overview
On November 24, 2014, Sony Pictures employees received a message from a hacker group claiming to have stolen the company's internal secrets. Internal analyses confirmed the data breach and revealed that the hack might have been ongoing for more than a year leading up to the official announcement. Reports indicated that hackers obtained as much as 100 terabytes of data, though the exact volume was impossible to determine.
Sony IT systems remained offline for two days and the hacking group, calling themselves the Guardians of Peace, illegally released five Sony Pictures films through file-sharing websites. The following day, the hacker group released statements criticizing Sony's impending comedy The Interview, about two Americans asked to assassinate North Korean leader Kim Jong-un. The FBI launched an investigation into the cyberattack on December 1, partially to determine whether the incident constituted a foreign threat and whether North Korea was involved in the incident. North Korea denied any connection, but criticized the film as inviting terrorism against itself. On December 8, the Guardians of Peace posted another message warning Sony to "stop immediately showing the movie of terrorism which can break regional peace and cause the War."
Meanwhile, news outlets sifting through the data dump revealed embarrassing internal e-mails between Sony cochair Amy Pascal and film producer Scott Rudin. Some involved insulting remarks about actors Angelina Jolie and Andrew Garfield, among others, and another series of e-mails included racially insensitive comments regarding President Barack Obama's presumed taste in films. Shortly thereafter, screenwriter Aaron Sorkin, along with a number of actors and other industry workers, released statements condemning the press for violating privacy by publicizing leaked information.
In addition, hackers also released passwords, insurance and medical files, and salary information for thousands of Sony executives, actors, and employees. Nine former employees eventually filed a class-action suit against Sony for failing to warn employees about the breach and for failing to provide adequate security.
On December 16, hackers issued a statement threatening violence against theaters that showed The Interview in its nationwide premier on Christmas Day. Though the FBI and Department of Homeland Security believed there was no credible threat, Sony pictures eventually cancelled the release of the film and related press appearances. Sony's decision was, in part, a response to a number of theater chains announcing they would not show the film on the scheduled release date.
FBI press statements given on December 19 confirmed that North Korean IP addresses had been linked to the data breach, thus suggesting North Korean involvement. President Obama criticized theater chains and Sony Pictures for capitulating to the hackers' demands and promised action against North Korea, while the North Korean government denied any involvement in the breach. On December 23, Sony Pictures announced that it would release the film as scheduled, and the Christmas Day theatrical and subsequent streaming release of the film proceeded without incident.
Despite official FBI findings, some independent cybersecurity companies and tech journalists, notably Wired magazine's Kim Zetter, cast doubt on the North Korean connection. Kurt Stammberger, of the cybersecurity firm Norse, argued that the attack more likely originated from inside Sony, and indicated a possible connection to recent restructuring efforts that had resulted in job losses.
Key Figures
Kim Jong-un: Supreme Leader of the Democratic People's Republic of Korea whose assassination is depicted in the 2014 comedy film The Interview.
Barack Obama: US president who criticized the North Korean government for potential involvement and urged Sony and national theater chains to avoid bowing to terrorist demands.
Amy Pascal: Former cochair of Sony whose private e-mails were revealed after the Sony data breach; she resigned in 2015.
Scott Rudin: Theatrical and television producer whose controversial e-mails were released during the Sony data breach.
Bibliography
Lewis, D. (2014, December 17). Sony Pictures: The data breach and how the criminals won. Forbes. Retrieved from http://www.forbes.com/sites/davelewis/2014/12/17/sony-pictures-how-the-criminal-hackers-won/
Shoard, C. (2014, December 18). Sony hack: The plot to kill The Interview-A timeline so far. Guardian. Retrieved from http://www.theguardian.com/film/2014/dec/18/sony-hack-the-interview-timeline
Silverman, R. E., & Fritz, B. (2014, December 4). Data breach sets off upheaval at Sony Pictures. Wall Street Journal. Retrieved from http://www.wsj.com/articles/data-breach-sets-off-upheaval-at-sony-pictures-1417657799
Tsotsis, A. (2014, December 16). Employee data breach the worst part of Sony hack. Techcrunch. Retrieved from http://techcrunch.com/2014/12/16/hack-sony-twice-shame-on-sony/
Zetter, K. (2014, December 3). Sony got hacked hard: What we know and don't know so far. Wired. Retrieved from http://www.wired.com/2014/12/sony-hack-what-we-know/