PlayStation Network users fear identity theft after major data leak

Sony issues worldwide alert after personal details of 77 million PlayStation users, including 3 million Britons, stolen by hackers

Up to 3 million Britons are believed to be among the 77 million users of Sony's PlayStation Network, which has been hacked into by criminals who have stolen users' personal information, possibly including credit card details.

Reeling from one of the worst such security breaches in history, Sony warned all users of the PSN network – used to play games online and download content including films – that they should be alert for fraudulent activity on their credit cards. Users have been warned to be wary of "phishing" emails pretending to be updates or security information, and to urgently change the passwords on any sites or services that use the same password as their PSN username.

The firm conducted a "forensic security" examination and discovered a hacker, or hackers, had accessed the internal corporate computer systems that hold the details. The UK's information commissioner said he would ask Sony to explain the circumstances of the data leak, which might constitute a breach of the Data Protection Act.

The details of the users of the worldwide PlayStation Network – used by owners of Sony Playstation 3s and PlayStation Portables – include names, addresses, dates of birth, email addresses, and passwords to the network. They are a treasure trove potentially worth more than £100m to those who have stolen them if sold through online black markets, where the data required for an individual identity theft can cost up to $10, and a million unverified email addresses cost just $8.

Sony confirmed late on Tuesday that it had suffered an "intrusion" into its system on Wednesday 20 April, and that it had shut down the PSN and its Qriocity music streaming services as soon as the incident was discovered.

The PSN system was still down late on Wednesday. As well as costing Sony money the closure will be affecting a new generation of games companies that had hoped to use the system as a new means of selling games solely through downloads.

The admission will be a huge blow to Sony, which has been struggling to regain its once iconic status after years of missteps, and will increase pressure on its chief executive, Sir Howard Stringer.

Sony has not said how the hackers broke in. But Rik Ferguson, a computer security consultant at Trend Micro, said: "This has all the hallmarks of commercial criminal activity going for a saleable commodity. It doesn't look as though they would have broken in directly through the PlayStation Network. Far more likely is that they breached the corporate systems and then moved through them to access this valuable data."

The breach is one of the biggest ever, and in terms of the value of the data contained may be the most valuable to the hackers. In January 2009 a US payment card processor, Heartland Payment Systems, was hacked, affecting up to 100m cards; in March 2007 the systems of the store chain TK Maxx were hacked, leading to the theft of 46m credit card details.

However the PSN break-in is potentially more valuable because of the quality and breadth of data involved, as it could be used to construct an entire identity.

Security experts are wondering whether Microsoft's rival XBox Live service, which provides a similar function to Sony's PSN, could be targeted, though experts said it was a more closed system.

Dave Whitelegg, a data security blogger, said: "Microsoft's approach to [running a gaming network] is a bit more guarded than Sony's. The PSN is a much more open system. It's a whole different philosophy. A classic example is, on Xbox Live you do not get a web browser – the reason for that is security; it's a possible attack vector and could get you into their network. But the PlayStation 3 has one."

Ferguson said highly targeted commercial hacking attacks had increased recently, with large online repositories of information being targeted. The activism group Anonymous took the unusual step of insisting it was not behind the breach. It had previously attacked Sony over the company's legal complaints about gamers who tried to hack software that would let PS3s play any game.

"For once we didn't do it," the organisation, which describes itself as fighting for internet freedom, wrote on its blog. "AnonOps was not related to this incident and does not take responsibility for whatever has happened."

Sony has been criticised for the fact that the hackers have apparently been able to copy the data directly, implying it was not encrypted.

Almost every commercial site scrambles a user's password before storing it; when the user tries to log in, the password they provide is scrambled in the same way and then compared with the stored one, meaning the "plaintext" password is not available. It does not appear that Sony has done this.

Ian Shepherd, chief executive of video-games retailer Game Group, told Reuters: "The issue, the experience that Sony are having … is a really serious one. It's one we're staying very close to. I think there are lessons for the whole industry from the experience that Sony are having."

Many gamers expressed anger. On the PS3news.com online forum, PSN member Jarvis wrote: "Stop purchasing anything remotely related to Sony. Let companies who deal with Sony know that you can't support them if they continue to work with Sony."

But Ferguson said such threats were unlikely to amount to anything. "That's just frustration. There would be a real hardware cost in doing that. In fact, it's likely to be more like what happens after a terrorist attack: security is stepped up and everyone is much safer for some time afterwards."

Since Stinger's appointment in March 2005 he has struggled to break the company out of its "silo" organisation that has prevented co-ordination between different divisions.

But revenue and profits have both remained flat, while the company has struggled to make an impact in new areas. The PlayStation 3, launched in 2006 in Japan and 2007 elsewhere, is widely seen as third-placed behind Microsoft's Xbox and Nintendo's Wii, and has dragged down profits.

A series of other problems such as battery fires and spyware embedded on music CDs have not helped its reputation either, and Stringer is now widely seen as being vulnerable if the company's performance does not improve.

Meanwhile the first lawsuit resulting from the security breach has been filed.

It was filed on behalf of Kristopher Johns, 36, of Alabama. Johns accuses Sony of not taking "reasonable care to protect, encrypt, and secure the private and sensitive data of its users."