Sony PlayStation Network breach

On 26 April 2011, Sony confirmed that intruders had breached its PlayStation Network (PSN) and Qriocity streaming service, exposing personal data on roughly 77 million accounts. The company had already taken the services offline days earlier, beginning a 23-day global outage that left tens of millions of gamers locked out and turned the incident into one of the most visible consumer data breaches of its era.

What happened

The intrusion occurred between roughly 17 and 19 April 2011. On 20 April, after detecting unauthorized activity, Sony abruptly took PSN and Qriocity offline — initially offering little explanation, which fueled days of confusion and criticism. It was not until 26 April that Sony confirmed the scope: attackers had obtained account data including names, physical and email addresses, birthdates, account login IDs and passwords, and potentially purchase history and security questions.

Sony said it could not rule out that credit-card data was also taken; press reporting at the time put the number of cards potentially involved at around 10 million, though Sony stated the card table was encrypted. Days later, the company disclosed a separate breach of Sony Online Entertainment, adding roughly 24.6 million more accounts to the total.

The outage

The breach was as much an availability event as a data-confidentiality one. With PSN down, online multiplayer, the PlayStation Store, and Qriocity streaming were all unavailable for about 23 days — at the time the longest PSN outage in its history. Sony rebuilt and re-secured its network infrastructure before bringing services back in phases starting 14 May 2011, and launched a "Welcome Back" program offering free games and content to win back trust.

Impact

• Personal data on approximately 77 million PSN/Qriocity accounts was compromised, with about 24.6 million more affected via Sony Online Entertainment.
• The network was offline for roughly 23 days (about 552 hours), disrupting tens of millions of users.
• Sony estimated breach-related costs at around $171 million.
• In 2014, Sony agreed to a class-action settlement valued at up to $15 million in games, virtual currency, and identity-theft reimbursement. UK regulators separately fined Sony for the breach.

Why it matters

The PSN breach was a watershed for consumer-facing platform security and for breach-disclosure expectations. Sony was widely criticized for the delay and vagueness of its early communications — a cautionary example studied in incident-response training ever since. It also demonstrated that an online entertainment platform holds the same sensitive identity and payment data as a bank, and must defend it accordingly. The event hardened public and regulatory expectations around timely, candid breach notification and helped catalyze the broader push for stronger data-protection enforcement in the years that followed.