Sony Pictures

In 2014, Sony Pictures endured a devastating cyber attack resulting in the leakage of over 100 Terabytes of confidential data, including personal information, unreleased films, and internal communications. The attackers, masquerading as colleagues, sent phishing emails containing malicious attachments. A specific technique used was a fake Apple ID verification email. By combining data from LinkedIn and exploiting reused Apple ID logins, the attackers guessed passwords for Sony's network. Beyond the immediate financial impact, estimated over $100 million, the breach significantly damaged Sony Pictures' reputation, leading to a reevaluation of cyber security practices across the industry. This incident underscores the critical importance of employing strong, unique passwords for different online services and the need for continual vigilance against phishing attempts.

Source: https://hempsteadny.gov/635/Famous-Phishing-Incidents-from-History

TPRM report: https://scoringcyber.rankiteo.com/company/sony-pictures-entertainment

"id": "son441050724",
"linkid": "sony-pictures-entertainment",
"type": "Vulnerability",
"date": "12/2014",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Entertainment',
                        'name': 'Sony Pictures',
                        'type': 'Entertainment Company'}],
 'attack_vector': ['Phishing emails',
                   'Malicious attachments',
                   'Fake Apple ID verification email'],
 'data_breach': {'type_of_data_compromised': ['Personal information',
                                              'Unreleased films',
                                              'Internal communications']},
 'date_detected': '2014',
 'description': 'In 2014, Sony Pictures endured a devastating cyber attack '
                'resulting in the leakage of over 100 Terabytes of '
                'confidential data, including personal information, unreleased '
                'films, and internal communications. The attackers, '
                'masquerading as colleagues, sent phishing emails containing '
                'malicious attachments. A specific technique used was a fake '
                'Apple ID verification email. By combining data from LinkedIn '
                'and exploiting reused Apple ID logins, the attackers guessed '
                "passwords for Sony's network. Beyond the immediate financial "
                'impact, estimated over $100 million, the breach significantly '
                "damaged Sony Pictures' reputation, leading to a reevaluation "
                'of cyber security practices across the industry. This '
                'incident underscores the critical importance of employing '
                'strong, unique passwords for different online services and '
                'the need for continual vigilance against phishing attempts.',
 'impact': {'brand_reputation_impact': ["Significant damage to Sony Pictures' "
                                        'reputation'],
            'data_compromised': ['Personal information',
                                 'Unreleased films',
                                 'Internal communications'],
            'financial_loss': '$100 million'},
 'initial_access_broker': {'entry_point': ['Phishing emails',
                                           'Malicious attachments']},
 'lessons_learned': ['Employ strong, unique passwords for different online '
                     'services',
                     'Continual vigilance against phishing attempts'],
 'motivation': ['Data theft', 'Financial gain', 'Reputation damage'],
 'post_incident_analysis': {'root_causes': ['Reused Apple ID logins',
                                            'Weak passwords']},
 'threat_actor': 'Unknown',
 'title': 'Sony Pictures Cyber Attack',
 'type': 'Data Breach, Phishing',
 'vulnerability_exploited': ['Reused Apple ID logins', 'Weak passwords']}