PlayStation Network: hackers claim to have 2.2m credit cards

Discussions in hacker forums point to huge numbers of credit card details stolen from Sony's PlayStation Network, while some owners see fraud – but is it just coincidence?

Hackers in underground online forums are claiming to have access to credit card details stolen from Sony's PlayStation Network in mid-April, though security researchers say it is not possible to verify the claims.

The online discussions centre around a haul of 2.2m Sony customer credit card numbers that are claimed to have been copied during the attack, which led Sony to shut down the network for more than a week after it happened between 17 and 19 April.

At the same time some of the 77 million PSN users have begun to report discovering new fraudulent charges on their credit cards, though the timing could be coincidence and not linked directly to the breach. Any sufficiently large number of credit card owners is certain to include some who have recently been defrauded by other methods.

The claims of fraud include the equivalent of $1,500 spent in a German grocery store on an American credit card, and dozens of people reporting charges on items such as German airline tickets and Japanese stores.

Kevin Stevens, a security analyst with Trend Micro, said in a tweet that "the hackers that hacked PSN are selling off the DB [database]. They reportedly have 2.2m credit cards with CVVs" - the latter being the three-figure number required for "card not present" transactions.

But Stevens added that he couldn't be sure the claim was true. The hackers were also claiming to have offered to sell the database back to Sony, but that the company declined it. Sony spokesman Patrick Seybold said that as far as he knew there was no truth in that claim.

Speculation is growing that the hackers who carried out the attack could be European, based on the names being used in forums, though no further details have emerged so far.

One reader of Venturebeat said he had been contacted by Sony and told that his card might have been compromised, and discovered two new charges totalling $400 he hadn't made.

Sony insisted in a blog post that the credit card data it stored was encrypted: "While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility.

"If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however, that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system."