Which part was criminal?
Various employees have started civil suits claiming damages.
Their entire IT infrastructure was obliterated and they had to spend tons of money on IR and new security tools. So quite a bit of damage has been done already.
Various employees have started civil suits claiming damages.
Their entire IT infrastructure was obliterated and they had to spend tons of money on IR and new security tools. So quite a bit of damage has been done already.
The part where they don't establish most basic protection at least for their critical customer data, after suffering from security breaches pretty much constantly[1] for over 3 years.
If you have an account with any Sony product (Playstation network etc.) then your personal and payment data (credit card numbers) have most likely been leaked not once but multiple times by now.
Why is Sony still allowed to store payment data? Why is their PCI certification not revoked?
As a layman I would argue that we know anyway that these kinds of laws are rarely ever enforced upon companies the size of Sony. Especially not when there's a political PR spin as convenient as "omg North Korea" (was: "omg terrorists").
However, the least that they have obviously violated (on multiple occasions) are the PCI-DSS diligence requirements and probably every data protection act under the sun.