PlayStation Network hack: what every user needs to know

Comprehensive guide to what's happened and what all PlayStation Network users need to do

Sony's PlayStation Network – the infrastructure that allows PS3 owners to play online games, as well as buy movies and other downloadable content – has been infiltrated by an unknown hacker, and the customer details of up to 77 million users have been compromised.

But how worried should we be, and what can PSN users do to protect themselves? Here are a few of the answers we have so far ...

What has happened?
Between 17 April and 19 April, Sony realised there had been an "unauthorised intrusion" on the PlayStation Network and Qriocity services. The company shut the services down and undertook an investigation. It claims that the full extent of the security breach was only understood yesterday.

How has this happened?
Good question – and one that Sony should be required to answer as soon as possible. Indeed, US senator Richard Blumenthal has written to SCEA president Jack Tretton demanding an explanation. It seems, though, that there have been recurrent weaknesses in the PSN security infrastructure. In January, the PS3 system root key, which authorises software running on the machine, was hacked, potentially allowing pirated games and unauthorised software to run on "jailbroken" PS3s. There are now numerous coding sites offering custom firmware, allowing PlayStation owners to run their own apps and operating systems on the machine. This is not unique to Sony's console however: both the Wii and Xbox 360 can be "hacked" to run pirated software – however, the accounts and personal details of other console customers have not been involved on this scale.

What have the hackers obtained?
It seems that any personal information you have entered into the PSN service is vulnerable. That means your name, address (including postcode), country, email address, birthdate, PlayStation Network/Qriocity password, login, password security answers, and your PSN online ID. Sony says that it is also possible that your profile data may have been obtained, "including purchase history and billing address". If you have used your credit card to buy downloadable content via PSN or Qriocity, your credit card details, excluding your security number (usually the three-digit number on the reverse of the card, on the signature panel) may have been obtained. Sony is stressing that all of this is a possibility; it doesn't know for definite that the hacker has acquired all of this information.

What should I do about my PSN account now?
While the network is down, there's not much you can do. Sony won't say when the service is going back online, but when it does, you should immediately change your PSN password.

What other precautions should I take?
If you use the same password elsewhere online, change every instance. Ideally, you should employ different passwords on every secure site you use. From now on, try to make your passwords as un-guessable as possible. Use numbers, capitals and symbols. When the Gawker network was hacked last year it was discovered that the most popular password among users was "12345"; the second was "password". That's not a good idea if you have credit card information to protect. If you use a Google Mail account to access secure sites, consider employing two-factor authentication.

Also, be aware that phishing scams will now be in operation: if you receive emails claiming to be from Sony and asking for account information or personal details, do not reply. Sony has stated that it will not email PSN users requesting details.

How will I know if my account has been compromised?
You probably won't know if someone holds your data until they attempt to use it. Keep a close eye on your credit card statements – look out for any unusual transactions and inform your bank or credit card company immediately if you see anything suspicious. If you are worried, you can pay for a credit card report from one of the three UK agencies: Experian, Equifax and Call Credit. They also run subscription services that monitor your account and alert you to suspicious activities. Senator Blumenthal has urged Sony to provide PSN users with free access to credit reporting services for two years. This is unlikely to happen. In its online FAQ, Sony has broached the subject of refunds, stating: "When the full services are restored and the length of the outage is known, we will assess the correct course of action."

When PSN is back online will it be safe?
Sony has said that it is rebuilding the service. The company has also bought in third-party security experts to trace the source of the hack. It's worth pointing out, however, that data security is an issue facing every site where customers hand over personal and financial details. There are question marks over whether online data systems can ever be 100% safe.