Sony hack leaked 47,000 Social Security numbers, celebrity data

Documents leaked online include the personal information, salaries, and home addresses for employees and freelancers who worked at the studio, a data security analyst finds.

Much of the data leaked from Sony hack was stored in Microsoft Excel files without password protection.

The security breach suffered by Sony Pictures Entertainment last month appears to have leaked far more personal information than previously believed, revealing the Social Security numbers of more than 47,000 celebrities, freelancers, and current and former Sony employees.

An analysis of 33,000 leaked SPE documents by data security software firm Identity Finder found the leaked files included the personal information, salaries, and home addresses for employees and freelancers who worked at the studio. Some of the celebrities include Sylvester Stallone, director Judd Apatow and Australian actress Rebel Wilson, according to the Wall Street Journal, which first reported on the analysis.

Other data identified as leaked to file-sharing networks after the breach include contracts, termination dates, termination reason, and other sensitive information, nearly all of which was stored in Microsoft Excel files without password protection, said Identity Finder CEO Todd Feinman.

SPE representatives did not respond to a request for comment.

The leak highlights the risk posed to large companies and organizations that store customer and employee information on computers attached to the Internet, Feinman said.

"This is a common theme of corporations today," Feinman told CNET, ticking off a list of recent security breach victims including Target, Home Depot and PF Changs. "They think they are protected by firewalls and perimeter security, but the border is becoming blurred, and attacks get through."

Identity Finder said it discovered more than 1.1 million SSNs in the files, but that many were duplicates. Sony Entertainment co-chair Amy Pascal's Social Security number was found in 104 separate locations, while Sony Entertainment CEO Michael Lynton's was found in 93 files.

The discovery of multiple copies of data this sensitive on multiple employees' computers or multiple times on a single employee's computer is unusual and dramatically raises a company's security risk, Feinman said.

Link:
Sony hack leaked 47,000 Social Security numbers, celebrity data