That is correct. In the case of Sony, Sony's servers were breached not those of their CA.