Sony Pictures Entertainment hack

On 24 November 2014, the morning before Thanksgiving, employees at Sony Pictures Entertainment in Culver City logged in to find a stylised skull on every workstation and a message from a previously-unheard-of group calling itself "Guardians of Peace". Behind the cover persona was North Korea's Lazarus Group, which had detonated a destructive wiper across roughly half of Sony's IT estate and exfiltrated terabytes of internal data ahead of the destruction.

What happened

Lazarus operators had been resident on Sony Pictures' network since approximately September 2014, gaining access via spearphishing of senior executives and dwelling for months while harvesting credentials and mapping the environment. The U.S. FBI's later analysis suggested credentials had been compromised over the preceding months and stockpiled for the eventual destructive payload.

On 24 November, the operators triggered the wiper. The malware:

• Destroyed data on ~3,000 servers and ~6,000 employee laptops — roughly half of Sony Pictures' total IT estate.
• Disabled Sony Pictures' internal email, telephone systems, payroll, and most production-related infrastructure.
• Left employees physically present in the office with no working computers and reduced to using paper documents and personal phones for over a week.

In parallel, Guardians of Peace began leaking the exfiltrated data online:

• Five unreleased films including "Annie", "Fury", and "Mr. Turner" (Sony reported $5M in resulting lost revenue).
• Internal emails between executives, agents, and producers, including embarrassing remarks about actors and senior Hollywood figures.
• Personal data on 47,000 current and former employees — names, social security numbers, medical claims, family details.
• Unreleased scripts and contract documents.

The Interview

The attack was widely interpreted as retaliation for "The Interview", a Sony comedy depicting the assassination of North Korean leader Kim Jong Un, due for theatrical release on 25 December 2014. On 16 December, Guardians of Peace published a message warning of 9/11-style attacks against cinemas that screened the film.

The four major U.S. cinema chains — AMC, Regal, Cinemark, Carmike, Cineplex — pulled the film. Sony cancelled the theatrical release. Public criticism, including from then-President Obama, prompted Sony to reverse the decision and release the film through a limited theatrical and streaming distribution.

Impact

• Direct IT remediation cost: ~$35M.
• Lost revenue, business interruption, and class action settlements: ~$50M+ over subsequent years.
• Personal data class action settlement: $15M to current and former employees in 2015.
• The Interview's lost theatrical release and re-release via on-demand was estimated at $30M in foregone revenue.
• CEO Michael Lynton and several senior executives stepped down within the following two years.

Attribution

The U.S. FBI publicly attributed the attack to North Korea on 19 December 2014 — at the time, the most explicit U.S. government cyberattack attribution to a state actor on record. In September 2018, the DOJ unsealed an indictment naming Park Jin Hyok, a Lazarus operator, as a participant in the Sony attack along with WannaCry (2017) and the Bangladesh Bank SWIFT heist (2016). The forensic case linked all three operations via shared malware code and command-and-control infrastructure.

Why it matters

Sony Pictures is the first widely-known nation-state cyberattack on a private company for political reasons, and remains the canonical case for destructive-cyber-as-coercion. It also established a template Lazarus has reused at scale since: long dwell, credential staging, destructive wipe, public extortion-with-political-framing. The same operational lineage led to WannaCry, the Bangladesh Bank heist, and over $3 billion in subsequent cryptocurrency thefts.

The incident also reset corporate thinking on:

• Insider data exposure — Sony's email leak is still cited as the most consequential corporate-email exposure in history.
• Insurance for nation-state attacks — the Sony incident was an early test case for what cyber insurance covers when the attribution points to a state actor.
• Executive-level cyber accountability — the CEO turnover post-Sony foreshadowed the SEC's later disclosure rules around material cyber incidents.