6791 people are affected, Sony confirms May data leak

CTOnews.com, Oct. 5, Sony Interactive Entertainment recently sent emails to current and former employees and their families to inform them of the disclosure of personal information. Sony said in its announcement that it had emailed 6791 Americans and invited them to confirm their identity and resume service through Equifax by February 29, 2024.

Sony said the breach was initiated by an attacker through a zero-day vulnerability in the MOVEit Transfer platform. The vulnerability tracking number is CVE-2023-34362, which is a high-risk SQL injection vulnerability that can execute arbitrary code remotely.

CTOnews.com reported in July that Clop ransomware group used the vulnerability to launch a large-scale attack that endangered cosmetics brand Estée Lauder and other brands.

Clop blackmailed Software Group launched the invasion on May 28 this year. Sony discovered the attack three days later, in early June, and discovered unauthorized downloads. Sony then temporarily cut off the network and fixed the relevant vulnerabilities.

Related readings:

"Sony's response to hacking: under investigation"

Estée Lauder, a cosmetic brand, was attacked by BlackCat and Clop hackers at the same time and was asked to pay a large ransom.

"Microsoft warns that there is a zero-day vulnerability in MOVEit Transfer file sharing system, and hackers can modify database SQL statements at will."