“A PSN username”
Is it the same as the online ID I can share with people for them to add me or am I not understanding?

@get2sammyb Sad thing is, I don't think Sony even cares about its most influential or die-hard fans anymore, nor does the current management even seem to care about this or any of the other bad PR they've been inflicting on themselves this gen, but Hulst and likely other top suits need to go if Sony and more specifically Playstation want to remain in business going forward...

@ZorkDuskbloods Yes the very same...

Jesus, near $1000 machine with about as much security as a temu phone. This has been an ongoing issue with them for generations now.

So glad to wake up from the nostalgia coma and largely walked away from this company.

The only thing that will compel change is if more do as they continue down this anti consumer villain arc they chose this generation.

I honestly think there is more too it than this.

That data is far too basic for changes like this to be done.

@TensuraFan7 @get2sammyb
Doesn’t this mean that playing online games is unsafe because people will be able to see my online ID and vice versa? This is genuinely stupid.

@get2sammyb this is why I walked from Spotify, I had my account hacked there and it was basically support swapping vital details meaning they could change my pass and email. I actually “hacked” it back by using the same method a day or so later then changed everything about the account and promptly deleted. The thing is, they only asked for my account name and not even my email address! Be careful with user names across several accounts, I used to do this but I now thing of user names like passwords - different passwords for different accounts and now different users as well - this limits attack vectors slightly. Stay careful people!

@get2sammyb
I can’t wrap my head around how support can make changes that easily. It feels like such a basic process issue.

I’m wondering how much of PS Support is outsourced, and whether the third‑party teams just aren’t following proper verification steps or simply aren’t taking the risk seriously enough.

Because it really shouldn’t be complicated.

We had to provide ID and proof of age just to send messages… yet they can reset entire accounts with barely any meaningful DPA checks.

That can get a company into a regulatory investigation surely?

@get2sammyb
The amount of basic data you can get out of someone’s PSN profile is a lot now that I can think about it.

Someone might claim that this account is theirs and they bought a certain game on a specific date just by checking the trophy list. If support does not ask for more information like transaction ID, real name, etc., they can easily get the account.

This is very bad. The more I think about it, the easier it seems to get some of this public information.

They need to do better if they want a digital future.

@B-I-G-DEVIL
One thing I want to confirm is that PSN Support is in fact outsourced.

In my country, we contact the official PS support via a phone number that connects us to Arabic-speaking agents from a different country.

The agents are very clueless most of the time and are not trained, and you could literally hear other agents talking and gather other people’s information.

I speak this from experience when I had the misfortune to get in contact with them.

Kinda crazy that Sony didn't do anything to really alleviate this, especially after how it kinda blew up earlier in the year.

Security is so important and the fact that someone can get into a person's account so easily is not good, obviously.

Most of this comes down to social engineering and when that is the case the company/Sony will never admit to it. A breech is different, then they have to notify the data commission within seventy-two hours. Not even my friends know my user name/email address/or my purchase history. The reality is that you really have to (bleep) someone off for them to go to the bother of hijacking your account. If you aren't a voice in the community you aren't on anyone's radar.

I'm not excusing that kind of behavior, someone here tried to DoX me recently so I understand the risks, they didn't get far and I can't discuss the rest just that it was dealt with. If I look on Tor right now to takedown a PSN account you are talking 1.2K USD (max) that's 'high profile'. A standard account is 10 to 50 USD, bulk logs are 5 USD per account at packages of 100,000+ accounts. People do need to be careful. I see this game Fifa being hit all day long, people don't even know their accounts were rumbled through unless the person doing it takes players and these things. The real problem is that Sony/EA etc allow an account to be logged in through other means, i.e. outside of the console and there are tools to hijack an account that way too. The rest is social engineering and it's far too easy.

• I blurred my browser, hopefully it's breaking no rules. It's one of many vendors.

Edit: That's the reality, people sell and buy in bulk. There are accounts on there that are active and each user has no idea they've been breached, it only becomes a problem when they realize they are locked out. It's a big problem and a big earner. I've seen every account you can think of sold on vendors like that. The deepweb was my first internet, and other than this site and Youtube still is, it's safe in it's own way for me. Gaming/Accounts are extremely popular over there, everyone I know over there games. Make sure people over there aren't gaming with your account, stay safe.

Glad the only thing I'd lose is trophies if I got hacked.

So much convenient for all digital only future eh?! 😆

Not just we didn't owned our digital games but some basement dwellers can easily hacked our PSN account only from PSN name, email, and purchased date. That's just crazy!

On top of this nonsense, there's still publishers who can delisted games not just from digital store but also from our purchased library anytime they want.

Yeah, i fking refuse to go all digital with Sony until they fix their garbage security network and digital policy.

It feels like these hackers are targeting high profile accounts to deliberately draw attention to the piss poor protection, if they were doing it for personal gain, they'd surely avoid targeting anybody with a social media presence.

@Bluemoon2008 this is exactly what is happening. It’s much easier to get and hack their details than some random account.(wouldn’t surprise me if they are being hacked for other reasons too I.e someone doesn’t like them)

If not it would be a daily issue of random people losing their accounts + being sold in places. And this doesn’t seem to be happening.

So yes it is crazy that people can be hacked. But is it overblown? Most likely.

@Rezium I'm assuming you mean you don't own many/any digital games so you wouldn't be losing access to them?

But it's not just your trophies you'd lose if your account was hacked... You'd lose all of your game saves too. Think about how heartbreaking that is. I had to have my XBox 360 replaced back in the early days when you had to send the console in with the HD attached and there was no way to back up saves without the optional memory card... They sent back a completely different machine with a new HD, and even though there weren't many games on it at that time, losing my progress in "just" Oblivion, Ridge Racer 6 and Condemned Criminal Origins was super disheartening having to start over again... If you think about how many games you've played on your PS3 through PS5, you'd lose all of those saves and progress, and even those online only games that keep their saves in the cloud (stuff like Fortnite, Diablo 4 etc) would be gone because they're linked to your account.

We really need much better policies and security in place to protect our accounts.

How do they find your email address???

Idk why push square makes it seem accounts get hacked left to right on ps if that was the case we would hear me about it I feel there more to this story why this one person was single out

Thanks to AI, hacking is getting crazy easy. My work and personal accounts have been compromised several times this year. Even after changing passwords.
In a case where you're a high profile user being targeted, you almost have no chance.
I work in the IT field and remember when zero day exploits typically gave you a good safe window of 2-4 weeks to patch. That is not the case anymore. Patch the exploit immediately or suffer the consequences, and half the time hackers know about the exploit before you do.

@Rezium It depends on what else you use your PSN email for and how you pay for your digital games/Plus+ , it's all linked and provides a trial right back to your other accounts. There's a Pwnd page on the deepweb where I could put your username into and every crumb of information relating to your username would come right up. These trophy sites that people join to track their progress are major targets for data scrapes. I have three PSN accounts and three separate email accounts for each, all three are only used for the PSN. I don't use credit cards, only Bitcoin and for the PSN only cards.

And oddly enough I remember a vendor that organized accounts for sale by their trophy count too which to me was crazy because most people want to earn them but I think when you do occupy the space you develop that mindset. My first Clan started off hacking games, I quit when realized we had an advantage in Day-Z because they'd been hacking comms. It started with 'kat look at all these foxes', they'd been hacking player models into animals, I didn't know. Comms meant they'd broken into the other teams chat Apps and knew what they were planning. It ruined the game for the other team. There's something that can be done with the PSN chat too, it involves an external packet sniffer so all I'd say is don't accept party invites from people you don't know, it's a popular method to cause trouble.

It might be cultural too I've been around hackers my whole life, they are everywhere on those networks. Most of the Xbox ones seem to be Americans, they are the ones who SWAT, send police to the home because they have a blowout on Call of Duty or were talked down to. My new friends play for the other team, work with Fortune 500s/etc to ensure their network is safe, take bounties to break networks (for the owner) some other jobs.

@nomither6 Breadcrumbs, you are leaving them right now. Or (for example) you use Visa for the PSN, they get breached, your transaction history is traded between data vendors (this happens all day long) the person then matches your PSN ID/username with the email address (there are tools for that, it's fast) they then contact Sony with 'proof' that they are you, and to Sony's current internal policy it does look like you are who you say you are. Sony should then request 2FA and they don't, they then manually override the account settings for 'you', change the original email address to 'your' new one, then it's no longer your account. Another way is through the trophy sites I mentioned, when you create that public account you need to be sure that whoever is running the site understands security, not all do. Most of it is carefully matching data/AI too that is already readily available, it doesn't require a lot of heavy lifting because someone else already did that part.

Love it, the 2028 onwards all-digital future is looking more and more appealing by the minute

This is why I don’t share more than I need to online. Paranoia has served me well so far.

That answers my question from the other day. Unbelievable that this hasn't been sorted and is still happening.

A couple of years ago I realised that the PS Vita version of Tearaway and the PS4 version of Driveclub disappeared from my account and it was asking me to pay again for them. I found the transaction history and had the proof I had bought them. I called customer service multiple times and they said me that the transactions are so old and they cannot do anything!

@get2sammyb
I can confirm this is not true. My son had a PSN login and Sony refused to change the email address associated to it even with all the proper information. I had to login to that account and we couldn't remember what the information was.

@Chrisathickson 'years ago' their current policy is that they will. That's why it's happening and has been happening. You are going by an outdated experience, the current situation is very different and calling the article rage bait when people like Sammy are trying to spread awareness is wrong too. People do need to be careful, it's not a false narrative it's the reality of what's happening and why. You might not agree with the message, others understand that risks and appreciate that awareness.

@PuppetMaster just out of curiosity, which games have been removed from users’ purchased library ?

I’ve been on PSN since 2007 and have never lost a game I purchased digitally.

What's the point of these extra security features if Sony will happily give you access to the account if you give them the accounts email address? Sony really needs to tighten its security and tell their tech support its a sackable offence if they just give access to accounts to anyone who asks.

@Balaam_ Says the guy who buys DLC he doesn't want to a game he doesn't like just so he can have 100% trophies on that game.

@B-I-G-DEVIL Yeah Sony needs to sort out its tech support because their tech support operate on their own ruleset depending on the day. The fact i could easily take over let's say my friends PSN account because i know enough about it to fool some useless gullible tech support staff is worrying.

My advice people is to use a passkey. Its not perfect and has its own issues but its by far the best security method on PS. It makes hacking a lot harder.

Several years back Sony gave my UK based account to some random Russian speaking individual through a similar sort of customer service scam. I recall the agent I spoke to about returning it didn't seem to think my sudden change of language was a clue at all. I got them to provide me with the customer service log, the thief basically asked and received.

@DennisReynolds Exactly, if they can retrain their staff in their Thalgau plant then they can retrain support. Hacking doesn't mean sitting on a machine all day, it can be done with the same phone most people use to access this site. I knew a guy, he's what you'd call a master manipulator and with a voice to match. I asked him to run his game on me to see how far he could get. Now granted he knew me well enough to know what to say but I knew him well enough to catch those tells, it didn't matter he reduced me to nothing in no time at all. I'm flustered even thinking of that night, those people are good. Support have no chance when dealing with someone like that. His method was to be the concerned Dad who's child forgot their login details for various Apps. As soon as he hooked a female he had her. It's no different than those Boyfriend scammers, females do it too.

@Bot_Bot_69 It was me (not really) I did say 'culturally' because my part of the world is where a lot of it is coming from and justification is sanctions. People like you have UK/Europe accounts and that's what's sought after. All that's needed is the right VPN and that person is back on the network. It's not something I'm proud of but it's not something I ignore either.

Question, is having a passkey safer than having both password and 2factor enabled when ot comes to normal hacks?

@GirlVersusGame I'm not certain they were Russian, just that they used the Russian language. It was long before Putin's war, pretty sure pre 2014 too, not really sure if Russia was on the receiving end of any sanctions at that time. It wasn't a big deal, at the time I hadn't used it in ages and it just took the one call to retrieve it I think.

You shouldn't have to feel a lack of pride in it or anything at all, not your sins. I remember seeing an exposé on a call center based in Spain that was scamming UK pensioners out of their life's savings, the employees were British, ever country births it's own supply of degenerates.

@HeeHo Your passkey is tied to the actual playstation.com domain. Your device mathematically refuses to share the key with a fake site, it makes it harder for phishing sites and scripts to pull the data or to trick a person into typing their password or entering a 2FA in real-time. Sony only stores a public key. That means a breach won't give the person/group doing it usable data that they can use to log into your account. It can't be-used therefore it can't be brute forced either.

The login token you use is locked locally to your physical device hardware, this is also why people have their phones stolen. It's for that Bitcoin wallet and it's protected with a passkey that can only be used through the original device. Doing it that way converts your login process into a hardware-bound cryptographic handshake, people use it for a reason. The only downside is that Sony's back-end routing has previously allowed certain session bypasses. Sony keep patching those system vulnerabilities, but using a passkey remains the absolute best defense against individual credential hacks, phishing, and password leaks. I hope that made sense.

@OrbiterNightfall For my case, Chaos Rings 1 and Disgaea 1 PS2 classic was gone from my account after Sony / Square / NIS delisted the game from PS store. For @belmont up there he lost Tearaway and Driveclub from his account.

@GirlVersusGame Thanks for the informative answer, I guess I'll start using one instead then to be safe.

It's okay if your account is stolen because a reasonable customer would understand that they don't really own their accounts anyway

@HeeHo You're welcome but do some research about it first, I grabbed some feedback from a chatroom when you asked. The person I did want to ask was already off for the night.

@Bot_Bot_69 I remember seeing an exposé on a call center based in Spain that was scamming UK pensioners out of their life's savings, the employees were British, ever country births it's own supply of degenerates.

• One of the first operations I watched over there involved an old lady, she'd been a school teacher who'd been saving her whole life and wanted to provide for her grandchildren. One day she got scammed, they took everything. I'd just joined my group and they were talking to her through a broker/fixer, they were working with law enforcement to trace the wallets and catch the person, they did penetrate the blockchain. He'd spent everything, my friends worked to make her whole again. Another was an elderly man from a good Family who'd built a law firm, he was so old that he didn't understand what was happening to him. I wasn't allowed to talk to him either, just listen and observe. I heard him crying, it was rough and I had to log.

The broker worked with the group who scammed him and it took weeks. It was a ransom attack, his business was hemorrhaging money because it was locked down and he didn't understand any of it. They were trying to explain that his files were locked, he thought they were physical. The group wanted a specific sum (it's never the full amount) the broker told them time and time again that he was an old man and was trying to borrow money to pay them. For that group it was reputation, if they accepted too little they'd appear soft. I didn't deal with scammers, I was there to decoy, and I did for two-years. People thought they were talking to someone much younger and all it took was some cat ears and cosplay to convince them, I can't say why I did that other than I had my own reasons and they were justified.

I think everything I've seen over there and continue to see comes from a lack of empathy and when someone enters that world it becomes a kind of hivemind of justification, I saw it in my own situation too. That was basically my childhood and though it was far from perfect I did survive it. Victims of scammers often don't, a lot of people unalive themselves after falling victim to scammers. They feel too ashamed to tell people, the same thing is happening right now to a lot of young British men. They are falling for romance scams/pig butchering and it's costing real lives. On the surface people see the financial cost, they don't see what it psychologically does to a victim nor is there victim support in any official capacity, they just live with it.

@HeeHo Yes. It won't stop dumb tech support screwing you over but it makes hacking a lot harder as passkeys are tied to your phone.

Sony don't give a damn about its customers so nothing will change.

@DennisReynolds That's why I said normal because I know this is down to the support being too lax.
But yeah any extra protection seems worth doing.

I mean Sony is the same company that have shown that they stored passwords as plain text files on their servers (from a data breach), then years later when they got breached again, they didn't even bother to secure passwords, as they were once again in plaintext.

Why would anyone care about their account? They don't own anything they've purchased digitally anyway. I thought everyone was fine with this.

I've made peace with losing my trophy list a while ago, when all the accounts suddenly had garbled and missing trophies. I've already had digital games disappear from my library. They were all PS+ games though because I've never paid for digital games unless they were digital only indies, which I tend to buy on Switch.

People need to genuinely get used to the concept of leasing game licences if they're OK with a digital only future. It will soon end up with fixed time licences for games that will gradually rise in price to renew.

All digital future baby. Don't forget - it's not just being hacked, you could also be banned permanently for arbitrary reasons. Just like that all of your games will be gone. No recourse.

Sony either gets its security 💩 in order or they can kiss their all-digital monopoly over PlayStation software distribution goodbye.

@get2sammyb "This may not have been a particularly big deal in the early PS3 days." It was worse. The ps3 was hacked left right and center. Online play was littered with cheaters and scumbags. The psn network was far worse than it is now. Remember when it was offline for god knows how long (I forget exactly how long) due to the worst breach in sonys history. This whilst bad isn't anywhere near the worst of the situation.

I've had fraud transactions multiple times on my debit card. One time somebody was able to withdraw $4,000 at a bank because they had the last four digits of my bank account number and my name. This seems like another version of that just with PlayStation accounts. I've had to stop using passwords that I used for a long time because they got leaked. It's very frustrating that it's so easy to get hacked. When that person withdrew $4,000 from my account that could have ruined me if it was just a few years earlier. I wasn't able to recoup the money for about 5 months from the bank going through the fraud process. If my PSN account was to be hacked that would be thousands of dollars lost for me. I've started buying physical in the last few years but for many years I only bought digital not realizing how vulnerable we are.

@KundaliniRising333 let's not pretend your gaming pc which you paid a considerable amount for is impervious to this kind of thing. If somebody really wanted to hack your steam accounts etc they would and you know they would find a way. This could happen to any platform no matter how good you think your security measures are.

@SpaceGhostC2C yeah but digital is better don't forget.

@get2sammyb what blows my mind is why they simply don't send an email and notification to the PS App asking if you're trying to change your login information. This is the whole point of 2FA and by itself would easily prevent this

@themightyant yes it's tricky but surely them such messaging the existing 2FA and have a waiting period for a response would cover a lot of the issues, even having the existing user logon to a known device inbetween immediately negates the request. Perhaps even have a time limit of PSN not being used at all before you can attempt to recover it, as I'd imagine the high profile ones we've seen are regular users, so if you've logged on yesterday its probably not genuine. There's no perfect solution but I'd say there are some very basic things they could be doing to catch the vast majority of these issues

@Northern_munkey This is hyperbole. PS3 online was not infested with cheaters. They existed, but aside from the outage, the PS3 online was not bad. I have both PS3 and 360 - the online was your usual laggy 7th gen experience for both. Pretty much any game that wasn’t call of duty had lags or jitters.

I wish they'd hack Ziff Davis.

When are you going to admit this is PlayStation worst generation ever!

I've been saying this all year and I got nothing but flack "buttt the gammmmes"

Sony has put out less exclusives this generation than any other and along the way Sony has done everything possible to ***** their fan base!

@nomither6 I agree!

@SpaceGhostC2C If my PSN account was to be hacked that would be thousands of dollars lost for me. I've started buying physical in the last few years but for many years I only bought digital not realizing how vulnerable we are.

• That's pretty much what it comes down to. The main reason people are buying those accounts are for the pre-existing library of games a person bought. I was looking at the prices again today and an account with two-hundred+ games was going for just under fifty USD. When you think of how much each game costs they are trading them for pennies on the dollar but the person had to work their fingers to the bone to earn those games. It's not counting Plus+ titles, just the games purchased on the account.

It's the same mentality as piracy, I saw Plague Tale leak one week early and get thousands of downloads which did directly affect sales. On the surface-web people see the more public trackers, they think 'those numbers aren't that high', I always say add another zero. If a person has no qualms stealing from the Developer then they have none for stealing from other gamers either and with cyber-crime it's a kind of nothing burger until it happens to the person. Then like you said it can ruin a person and usually does.

Huh.

Years and years of digital games yoinked despite 2fa and secure passwords.

Thank goodness Sony is pushing this all digital future, eh? Cant imaging how that’ll be a bad thing.

After the console was just broken open too

Still waiting for coverage gents @get2sammyb @LiamCroft

Sony won’t address the issue until threatened with a lawsuit, and why should they? It’s not like it will have an adverse impact on the brands popularity or their projected profits 🤷‍♂️.

@Jacko11 most people's consoles have already been updated beyond that jailbreak. Its not in pushsquares interests to report on it anyway.

Good luck to everyone going all digital. If your account gets hacked you lose everything. This is something they really need to change and add extra security for Playstation owners.

@nomither6 the latter stage of the ps3 once that jailbreak exploit hit was quite the horrible time to be playing online. Call of duty 2 and black ops were awful just to name a couple. Hyperbole? Is that what telling the truth is called now? Maybe my experience was rougher than yours but that's how it was for me and my mates. We all went the way of the pc after that and I'd still be pc gaming if it wasn't for the fact my pc went kaput.

@Northern_munkey When LittleBigPlanet was hacked people were force joining my game, you know how that ended. It can vary from 'this hack ruined my session' to 'this hack ruined my life'. It all depends on what was used and how, I loved that game but it was targeted for a reason and the people who bought those scripts for that game had one thing in mind. For Day-Z is was like I said people/my Clan hacking player models/comms (voice chat) the rest was my Siege team hacking through walls, I left both Clans. I couldn't leave LittleBigPlanet until those people went to prison, they needed those hacks to get to me in the first place. LBP.me was wide open too.

So 'maybe my experience was rougher than yours'. Always to me leads back to this chat, he was in prison because of me and still had a way to get back onto the network. My Dad sent a SWAT team to his home, had him raided, everything taken and he still got back into my life. Companies have a duty to protect their users/customers, the reality is that they can't.

This is what happens when you are on a crap platform run by donkeys!

@PS_No_Games_2 not a PlayStation gamer then?

PlayStation need to get it together with this thing.

@GirlVersusGame "These trophy sites that people join to track their progress are major targets for data scrapes."

Yeah people just love to share their info on third party apps. Always ridiculous when I see people add numbers that look like their year of birth to their usernames.

@PuppetMaster Sounds like my friend, he thought they removed his Driveclub from his account but it was only delisted from the store so he couldnt see it. I downloaded the game from his library without any problems... Delisted doesn't mean removed from library, unless it's a demo.

@TheArt to be fair, sites like Truetrophies and Trueachievements do good jobs of protecting your info, obviously they can't stop people finding your PSN ID. But they're pretty good at keep data safe.
I never play a game on the day I buy them anyway so they can't give that away for me.

Some people reading this article here seem to forget this isn't just related to Sony, or even consoles. The so called 'security' information you would need to 'hack' into various accounts people hold via calling up customer support is often so basic anyone could easily do it.

As people publicise more and more of their lives on social media, it becomes more and more simple.

@Zeke68 For my case, both games are delisted from the store and my library. And FYI, "hard delisting"; delisted from store and users library, already happened multiple times. Like Ubisoft The Crew, Creepy Tale 1 & 2, and Strike Force Kitty are some examples where these games delisted from stores and users digital library.

So, you're free to believes whatever you want. But it's possible, already happened, and will happen again.

This happens on every store the main thing is for it to return.

Social engineering isn't hacking. Social engineering relies on the person being scammed giving information out themselves.

@DanteDevilHunter It falls under the term hacking, source I just asked one.

Edit: Technically I asked multiple, they know about this article/etc.

being nobody account is better than high-profile account.

Maybe Sony could issue proof of purchase receipts by paper mail? A paper listing of all your purchases sent to the account owner for safe storage? in case their online account gets messed with they can show their paper account statement as evidence of what they own?

So dumb they wont confirm more information. I have to reattempt making a 1-time payment on a credit card after i forget the password because despite putting my social, may forget whether my card has my middle initial.
All some "hacker" has to do is look at a profile to see the last game played or guess the gamer bought the newest big game and they get the keys to the account.

These guys are gonna have a field day when GTA6 rolls out

@stalepie2 or they could just make it harder and ask to confirm address, phone numbers, etc. Just to log in to pay a bill more than enough places will text you a simple code to read back AFTER verifying demographics.
Some people spent thousands or tens of thousands so its asinine that's all it takes

Stop. Outsourcing. Support. A company in South America I can't remember the name of (will edit it in) that handles support has been caught selling accounts before. Of course they won't because end-stage capitalism but still.

@Chrisathickson @Slayer25c And here comes the experts who blame the users themselves and even Push Square for sharing this instead of demanding Sony to improve their laughable security…

This is one case, yet several other of prominent PS content creators have been going through the same thing for years now, and those are lucky since they can use their community and connections to maybe get his account back, but if you take a look at Reddit or other forums you’ll realize there’re SEVERAL cases like this, 99% with no solution at all, I mean there’s literally a whole black market store for PSN accounts but you can “confirm” this doesn’t happen lmao…

@IllusiveMan Sony paid their own employees eight-million USD when their system was breached and that information was compromised. It was part of the original GoP (Guardians of Peace) hack, if anyone remembers the Lazarus Group (probably not) it was the same group under another name. Basically state-sponsored by the DPRK (North Korea) They stole employee records and left a wiper, a kind of malware that knocked out thousands of Sony's computers/servers then erased critical network infrastructure.

The WannaCry tech was also their work, it hit hundreds of countries and brought services like the British NHS to it's knees. If you count every breach that resulted in stolen usable date (on Sony) it's twenty. Those same groups have moved passed brute-forcing Sony's core servers and now focus on those account takeovers. Automated account-recovery mechanisms do bypass 2FA so it's not just Support. They need to re-haul the entire internal policy relating to account recovery.

It's not new, this has been happening for a very long time. It takes someone known on Twitter and these things to say something, the vendor/capture I shared here last night is only one of (checks) thirty-two, selling bulk accounts. Each vendor has multiple sellers, the cheapest account I've seen (I'm sorting by Games Held at the moment) is four GBP. That doesn't sound like a lot but the whole packet costs (checks) 30,200,000 GBP (that's lowballing the dollar amount) so you can see why it's so lucrative and why it won't stop.

I have been getting 3rd party titles on Switch, after that happened to Moriary. I know if it happened to me I would never get my account back and PS will probably never solve the security problems. Can’t invest in a library like that.

Do better Sony

I don't get how they can do that. How are they able to login without the 2 step verification? And if they didn't log in, how were they able to change the email?

@CutchuSlow 2FA is being bypassed by Support, they aren't asking for it. The only proof they are requesting is transaction history which isn't really proof at all when a person can look at your trophy list and guess what that purchases was. I've made a bunch of posts up there that go into a lot of the nitty gritty. For a topic like this I always go to the source, I see the educational side as awareness and the people who share the information with me want others to be aware. It's part of that white hat Ethical thinking, it rubbed off on me too.

My wife couldn’t remember her Apple credentials a few years back. She got someone at Apple Support to start an account recovery process. Apple flooded her devices and linked accounts with messages for a week along the lines of “we have received a request to change your account details. If this was you, do nothing, if it was not you, contact us here. You have [x] days until this change takes effect.”

It was a pain in the butt for a legitimate request, but I would have thought making the process take a week would give most victims of this kind of social engineering via support hack time to respond and put a stop to it.

@StrickenBiged It's fifteen to thirty-minutes to do it on the PSN now. No password needed nor 2FA, they trick Support (easily) into manually resetting the accounts original email address to theirs. They only need the very basic of publicly leaked data such as your previous purchases/or an invoice number and your PSN ID. A console serial number helps too but they tend to not get those. It's a fast override for a reason, I've never heard of one going over half of an hour.

The biggest one with Apple is MFA bombing. It triggers their iforgot Apple portal multiple times causing dozens of native pop-ups to flood the chosen device and request a password reset. In fairness to Apple they've done a lot to protect their users by introducing systems and training that combat social-engineering and using A.I. to learn and analyze patterns in behavior/sensor data in real-time and it's working. What you described was their security delay switch, they hard-coded it into the system. It can last anywhere from a couple of hours to several weeks and it all depends on the scenario. It can't be bypassed by human Support either. It's as they say the waiting game.

Is it possible to change our eMail? I recommend getting on an eMail you use for literally nothing else if so. That way, no one can find the associated emIl address.

@AtlasLivesAgain It is, I have three PSN accounts and three separate emails for each. Those three get used on nothing else. I have three because I travel and jumping regions triggers their fraud detection system. I had one account frozen for two-weeks while they investigated, now it's easier for me to just use multiple. But a normal account sure, just contact support when you have one ready to go and explain that you are doing it to protect your account. It's common enough and also what hackers often say when they are hijacking an account in the first place.

The only problem then is if Sony get breached and your data is taken or if the method you use to pay for the PSN/Games is breached but even then the group doing it would have to break that data down and sell that data dump to a specific vendor, those chances are very low. Usually that kind of piggybacking is only done when the person is known/high profile. It's like if I knew your email address and submitted into a Pwnd system and dredged up everything you ever did on the surface-web, it's doable of course but you need someone invested in the person to bother. I'm sure you are a very interesting person I'm not saying you aren't, malicious activity to that degree generally requires malice and a kind of warped 'I'll get them', mindset. It's more likely a stalker would do it than someone on the 'job'.

@PuppetMaster Not sure about chaos rings and Disgaea ps 2 classics, but Drive club I can still download it and Tearaway hasn’t even been delisted from the store (even tearaway on vita I’m still able to download it)

What happens when you contact Sony regarding this? Do they not restore the games to your library?? Honestly I had never heard about someone losing games they had purchased before

@OrbiterNightfall

Honestly I had never heard about someone losing games they had purchased before

Sorry to say this but did you just got out from a cryogenic sleep or something? Just because you never heard of it doesn't mean this sh*t never happen. Here's one example where Ubisoft removed The Crew from users library.
https://news.instant-gaming.com/en/articles/5870-ubisoft-is-removing-the-crew-from-players-game-libraries

It was also happened recently for digital movies on PS store where Sony removed hundreds of Studio Canal movies from users library.
https://arstechnica.com/gadgets/2026/06/sony-erases-digital-content-from-libraries-were-reminded-we-dont-own-what-we-buy/

These companies can removed digital games, movies, music anytime they want from anyone library and no one can stop them. So contacting customers support is pretty much useless.

@Puppetmaster I didn't mean "library" like on the PS4 or PS5, I meant, log in on your friends PS Store account on a PC, click his portrait on the mainpage of PS Store. (up right corner) and choose "orderhistory" or whatever the englishword is for it, it's between subscriptions and game library in the PS Store menu. And scroll (for ages and ages) and I'm sure he will find his Driveclub there. 100%. If not, he never owned it on that account, 100% on that too. I worked with these systems, no way any game just get's deleted - either by mistake or otherwise. Only way to delete a game 100% is for Sony to delete you entire account...
I guess your friend a, bought the game on a different account and forgot that or b, he shared his account and got caught. (= account deleted).

@GirlVersusGame ok but how are they getting proof of purchase tho. Every purchase has a unique id number, right? Like a transaction id or order number. Wouldn't they need that to verify the purchase?

@KundaliniRising333 , I honestly think this is very illogical thing to say. There must be inreadible amount of attempts for any sorts of hacks, so I dont really think this is like "one attempt and they got in"
I would bet that Sony did something after first incident, but simply because result is the same now, or similar, it doesnt meant that process was exactly the same.
I am not trying to defend Sony, because this is not supposed to happen, but it is happening all the time everywhere. All I am trying to say is that I would bet that there were some "updates" in their security over last year.

@CutchuSlow Piggybacking off of pre-existing data. When people talk about data-brokers, that's surface level. If you for example pay for your PSN with a credit card, tomorrow that company gets breached and that data dump makes it's way down the line (which happens) your information is added to that Pwnd directory, somewhere a person can input for example your email address and anything leaked associated to it will pop up, home addresses, phone numbers/etc. It's all data and the hard part is compiling it (was, before A.I.) most of the PSN directories I see over there are American and it's because of companies like Master Card/Visa and banks in general being torn wide open. That data leaks and is sold/traded openly.

Someone matches services/PSN/Netflix etc and moves that data to the correct vendor, it's compiled in a kind of mix and match and if they go to the trouble of running a game on Support they have your account primed and ready for the taking. From the outside it looks like 'this is all Sony', it's not. It's everything associated to the email address you use with that account. If you were one of those high profile gamers on Twitter/etc you lose that anonymity fast, someone somewhere will get your ID/username and they'll run you through those data bases, and if they are the vindictive type use it to ruin your day/week, or life. Regular hackers aren't interested in doing one person, it's counter-productive when that same time can be used to make money. What's happening to those high profile/people is personal, it only takes one unhinged person to do that. They could even pay someone else to do it, 1.5K USD will do it with no questions asked, for the PSN I mean. Every platform has a price.

Edit: I should add that I'm not a hacker, like all subjects I prefer to get it from the source and that particular source is Ethical. I see it and my friends see it as education through awareness. Gaming means a lot to me and I'm not the type to ruin someone's life over a petty argument, I simply don't want to see someone get hurt/played by a system that can be avoided. When this topic does come up I go all in, there is a lot of mixed information/assumption behind hacking but most people don't associate with it/those people to understand it. Being miss-informed is just as dangerous.

@Northern_munkey

True. But I have more control over my security on my PC than I do on/with my PlayStation.
I’d also rather deal with Steam support any day of the week compared to Sony’s outsourced crap support.

Sony:

@GirlVersusGame Yeah, I figured of someone really wants to hack someone's account, they still will, but less chance like you say. My own account has many Plus games (Many of which I never even add) and many deep sale games, with most of the big releases I buy near release date on disc only. So, I know my account is pretty worthless to someone trying to make bank haha
Still, for people who pay out for many of the newest releases with their hard earned money, it must be a real bummer.

lol I worked out Sony doesn't give a **** about security the day they got hacked and what was it, 70 million user details stolen? They never have and never will care about security, because they don't want to spend the money and the Japanese are notoriously VERY bad with it.

There has been multiple events over the years since proving Sony hasn't changed a thing about it. And hence they'll never get my address etc details. And I'd rather sell my console then be forced into age verification with Sony!

Sony isn’t taking this account security issue seriously enough. How can we move to an all-digital future if people’s accounts can be compromised regardless of 2FA?

The irony is we are banking on people who get paid peanuts to handle our secure data properly, lol. It's a funny system when you think about it.

@wilky exactly we cant

This must be addressed soon, how do they think we need to move to an all digital future when stuff like this keeps happening.

The part that genuinely baffled me about the customer service chat for playstation, when I was trying to get back into my account that was randomly signed out and not letting me in, was that they wouldn't let me chat with an actual rep unless I was signed in but thats why i was trying to contact them, I couldnt lol

Hey glad Radec got his account back but it doesn’t change anything. Even beyond the physical media issue this is far away Sonys biggest problem.

When someone can scam you out of potentially thousands of dollars and hours of your life with an email and phone call how is this not being screamed from every corner of the internet?!?!

• After they got their account back.

I didn't even know there were PS5 influencers. All of this time I thought they were a gamer/streamer, unless that also falls under the same term. They need to put a lock on his account (something Apple do) for it to not happen again, if it happened to them once it can always happen again. At the same time what are they going to do about the thirty-two vendors who are selling accounts right now and the people who lost their accounts.

Those people don't even know (I never mentioned this part previously) when an account goes up (on the market place) it's sometimes still active meaning the user doesn't know. They continue to game/buy games until one day they get locked out and it becomes someone else's. It's going to happen a lot with Grand Theft Auto Six, there's a lot of hints and chatter.

A lot of people think the email account is switched there and then during the fifteen to thirty-minutes it takes to socially engineer (hack) support, that's not always the case. By leaving the account active the owner is scooping up new games and making it even tastier for the buyer. If it's data scraped from a log then Sony nor the user are aware of anything being off.

It's a multifaceted system, one that needs a proper solution and that doesn't just mean Sony beefing up their internal services/Support but also how they handle and archive payment histories because those are wide open too. They could prevent some of that by changing how they handle their invoices, it's too easy to piggyback onto a PSN account with so little data. Right now pass-keys and a separate email are the best prevention. I'd never not use one, they are on all three of my accounts, each account has a separate email address, I buy PSN cards with Bitcoin and know I'm safe from a lot of those methods.