It also says it might have been, which is much more worrying to me than the lack of evidence; because before this sony had no evidence that their network was compromised.

This whole thing seems like a great example of incompetence.

This compromise happened DAYS ago. Google was hacked by China in mid-December 2009 they didn't publicly announce what happened until January 12, 2010. What started to look like a harmless intrusion turned into compromised gmail accounts turned into a highly sophisticated attack on Chinese dissidents turned into a full scale assault on their infrastructure. People were still figuring out the extent of that attack a couple months later.

While this is a bad security breach, if you follow security news at all you'd know computer security is a joke. The Rustock botnet operated for FIVE years with impunity on as many as 2.4 million rooted machines. People didn't even know they were owned; their computers worked perfectly fine like nothing was wrong. Every system at pwn2own gets owned in seconds and you can bet the black hats were there first. Everyone gets compromised. The only thing stopping a crippling cyber attack is whether someone feels it is beneficial to do so.

I do not especially fault Sony for this. Google gets hacked. Microsoft gets hacked. The NSA gets hacked. The DoD gets hacked. JP Morgan Chase gets hacked. Just add another multi-national to the list. It's a systemic problem that nobody really cares enough about nor can we do much about it if we did care.

EDIT: Just to give you another idea of how screwed we are from a security perspective. To paraphrase George Carlin[1], some programmers are really stupid. Did you ever notice how much stupid software you see? Think of how stupid the average programmer is, and realize half the programmers are stupider than that. And that bottom half? They probably work in IT, managing over engineered address books and accounting ledgers of the world while smarter people worry about cooler problems.

[1] http://www.youtube.com/watch?v=8rh6qqsmxNs

Being a security guy, I agree that no amount of planning and intelligence will keep out a significantly determined attacker. However, this doesn't give you carte blanche to not think about security. All the evidence presented around this shows that they simply didn't make it difficult at all; as soon as the console fell, so did their system. They seem to have violated every rule in security. That is simply unacceptable.

It's one thing to be attacked by determined people and fail eventually -- given enough time, everyone does -- but it's a completely different matter to give the keys to the castle to anyone with a rooted PS3.

It doesn't mean they either know, or don't know. It means their PR isn't willing to fully disclose the exact nature because if they confirm customer data was nicked, class actions will start off rather promptly, and if they say it certainly wasn't, they're seen as over-reacting.

And it also says "we cannot rule out the possibility."

Sounds like lawyer-speak for "yeah, they got it".

To me it sounds like lawyer-speak for "We don't think they do but we're covering our arses"

Why can't it just mean "we don't have a clue whether they do or not?"

Because then there wouldn't be a conspiracy theory, of course!

(I'm not taking any chances, either way)

Not to be trite, but as they say, absence of evidence is not evidence of absence.

Especially considering the sentences immediately after the "there is no evidence..." statement, I'd be wary. I might just be jaded and they're really just trying to be forthcoming and helpful, but all that CYA-type-speak after that line makes me at least a little bit dubious that they're revealing all the details just yet.

I've always hated that saying. Absence of evidence is indeed evidence of absence, in situations where you would expect such evidence. It's absence of proof that isn't proof of absence.

That was a c-c-c-combo breaker. Bravo at articulating that.

When credit cards are involved you really need to prepare for the worst case scenario.

Thankfully that's what's great about credit cards (and let's not forget that) - you just ask the bank to deactivate the old one and no more transactions can go through. Also, you should in general not be liable for any fraudulent use of the number. Just dispute it. (my contract said I could be held liable for up to $50 of fraudulent use only in the case where the CARD was stolen and used prior to my reporting it.)

Right, but it's those poor schmucks who used their debit cards online as if they're credit cards that can get really screwed by this.

I absolutely do not trust them at this point. Why would I?