Sony admitted in today’s SOE security press release that on 16th and 17th April 2011 hackers may have acquired the following information from ~24.6 million SOE accounts.

Personal information potentially stolen:

• name
• address
• e-mail address
• birthdate
• gender
• phone number
• login name
• hashed password

On top of this, 12,700 non-U.S credit/debit card numbers and expiration dates (but not credit card security codes) and 10,700 direct debit records from Austria, Germany, Netherlands and Spain have also potentially been stolen from an “outdated” 2007 database.

Additional information potentially stolen from these 10,700 direct debit records include:

• bank account number
• customer name
• account name
• customer address

What’s SOE doing about this mess?

SOE have turned off all their game servers and have hired a security firm to conduct a full investigation into the incident. They have enhanced security and strengthened their network infrastructure. SOE have also said that it will grant customers 30 days of additional time on their subscriptions, and compensate them one day for each day the system is down.

“Additionally, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.”

As soon as SOE announce what these programs are will post the details. If you are worried then you could follow the suggestions in our Sony’s PSN Hacked – What Should You Do?

If you live in the UK, CIFAS have a Protective Registration service will help protect your name and personal details from misuse for £12 + VAT per year. With any luck, this will be the sort of service for which Sony will provide assistance. We’ll update this post as soon as we know more.

Basically, a hacker got into the system and probably has the following information from your account and any sub-accounts:

• Your registered address
• Country
• Email address
• Birthdate
• PlayStation Network/Qriocity password – if you’ve
• Login
• Password security answers
• Handle/PSN online ID

There’s no evidence this information was taken, but they can’t prove that it wasn’t:

• Purchase history
• Billing address
• Credit card number (but not cvv2/security code)
• Card expiration date

Also, your credit card details were encrypted.

Further details are in the Official PlayStation Outage FAQ.

Crap. So what do we do?

Don’t panic.

1. If you used the same password on PSN that you did on other accounts, go into those accounts and change your password now There are great suggestions on choosing secure, memorable passwords at WikiHow. Applying an algorithm for each site is very useful and simple to remember.
2. If you tend to use something like “Mother’s maiden name” for multiple accounts, go into those accounts and change your security question now.
3. Most credit card companies now require extra checks for online shopping like Verified by Visa on top of the CVV2 code from the back of your card, so you don’t need to worry too much about shopping. Keep an eye on your statements for the next month anyway.
4. However… with your DOB, billing address, card number and mother’s maiden name, the hackers may have enough info about you to lie their way into all sorts of things. I’d seek advice from your mortgage handler/personal banker/anyone else with important info. At the very least those people need a heads up that your info is no longer secure. They should be able to build other checks into their systems – I know my bank always ask for the amount and location of a recent withdrawal.
5. Your biggest risk is probably identity theft. Get a copy of your credit report from a credit reference agency like Experian, Call Credit or Equifax, in a few weeks time. Make sure there’s no unusual activity attached to your name – like unexplained queries or an extra mortgage. You can get further info on identity theft from IdentityTheft.org.uk
6. For our American readers here are links to the credit reference agencies in your country – Equifax, Experian and TransUnion

If you’re thinking about removing your card details from other services like Xbox Live, check out our step-by-step guide here: How To Remove Your Credit Card Details from Xbox Live – ONLINE!. Xbox servers haven’t been compromised (hope I haven’t jinxed anything by saying that) but I appreciate that some of you may want to play it safe.

All the best. Hope this breach doesn’t cause you too much hassle.

What are the banks saying?

Banks are well aware of the situation so if you do call them, there’s no need to explain the whole thing. Just mention the PlayStation hacking.

I called Barclays fraud line and was given two options. When pressed, they refused to comment on the relative security of either option, or talk about the risk of identity theft and emphasised that the choice is up to me.

1. I can ask for a replacement card, which will invalidate any payments on attempted on my current card. The new one will arrive within 2 working days.
2. I can stick with my current card and monitor my statements. If I notice any fraudulent transactions and reports them, I will receive a refund within 5 working days.

According to Twitter reports, Ulster bank are recommending you cancel your card and Lloyds are saying that there’s no need to cancel.

Halifax has a verified Twitter account that agrees that there’s no need to cancel cards and go on to advise customers to change any passwords that were shared with PSN.

Gamers around the world have been fighting an ongoing saga with Xbox.com over automatic renewal of their Xbox Live Gold and their credit card details. I won’t go into the gory details here but have a look at the comments section of our post from 2009, Remove Your Credit Card Details from Xbox Live – ONLINE!

One of the barriers to removing your credit card details over the web appeared to be the auto-renewal feature. We had lots of reports from people being told they had “an outstanding balance” and auto-renewal was the only thing from Microsoft that could be attached to their credit card. For a long time there was no way to turn off auto-renewal without calling up Xbox support, with all the grief that can bring.

Editor’s Note: We’ve been updating this page as Microsoft update their site. Comments below are not all reflective of the current version. These instructions were last updated on 12th July 2011

Edit 15th July 2011: It seems that yet again, within days of my creating this post, Microsoft have changed their site so that we can no longer update automatic renewal online. *sigh* Let me know in the comments if you CAN see a “(Change)” link in your screen, please.

Here’s how to turn off auto-renewal for Xbox Live:

1. Log in to http://www.xbox.com
2. Go to My Xbox > Accounts
   
3. Click on (Change) under Automatic Renewal
   
4. Scroll way down past all the tantalising features and click Next.
   
5. Select Off and click Next. Note that auto-renewal will switch itself back on every time you add a new pre-paid card. Rather an insidious practice, I feel…
   
6. Aaaand you’re done. Congrats!
   

As always, let me know if this doesn’t work for you.

One of our most popular post series’ is How to Remove Remove Credit Card Details from Xbox Live. The upshot of it all was basically… you can’t. Not properly. We tried the website. We tried phoning them up. 53 days later, Nick’s credit details were still on his Xbox Live account.

Stories came in from everywhere about people having the credit card problems. Scott wanted to stop his son from buying MS points indiscriminately – couldn’t do it. PrincessMeri spent two years asking Microsoft to stop billing her. Mark‘s account was hacked and $247 worth of points was charged to his card. People even made complaints to Watchdog and the Better Business Bureau (sadly, with no direct response). Lots of worldwide frustration over such a simple little thing.

We are now happy to report that Microsoft have finally added an option to remove your credit card details from your Xbox account! They no longer blacklist your card and you can add it back later if you change your mind.

Editor’s Note: We’ve been updating this page as Microsoft update their site. Comments below may not be reflective of the current version. This page was last updated on 12th July 2011

Here’s how. Click on the images to see full-size versions:

1. Log in to Xbox.com
2. Hover over My Xbox and click on Accounts
   
3. Click Manage Payment Options
   
4. You should now be presented with a list of your current credit cards. Click Remove for the card you wish to remove
   
5. Click Yes in the pop-up prompt
   
6. And if you’re lucky, your card might be removed. Unlike mine.
   

Going to the Payment method information page as instructed brings me to my Microsoft billing information. This reveals that my only existing service is “Prepaid 12M Xbox Gold”.

I’ve just turned off automatic renewal for Xbox Live Gold so there shouldn’t be any payments due but it still won’t let me remove my credit card. As such, I don’t hold out much hope for anyone else. Do let me know in the comments if you manage to remove your card. Good luck!

Update January 2011: Updated instructions and screenshots again for Xbox.com’s October redesign. Also discovered that with the current version of Xbox Live, it appears that you can no longer remove all your credit cards even when your subscription has been moved to a 12 month pre-pay. I had to attach a different credit card to my account before it would let me remove the old one. Very unimpressed, Microsoft.

Update: 11th Feb 2009

We’re getting reports that some people are having trouble removing their cards. Some even think this is a fake option on the site to placate us. Trust us, it’s not. You can actually remove your card details.

As Gabe says in the comments, they may have an active subscription using their credit card that needs to be cancelled first. I switched to a pre-paid 12 month subscription a few months ago, so the theory seems to hold true. If you get a customer service rep to explain this, let us know.

Our advice, buy pre-paid cards instead:

UK Links:

• Xbox Live 12 Month Gold Membership plus 2 free months – £34.99
• Xbox Live 3 Month Gold Membership Card – £9.99
• Xbox Live 4200 Points Card – £34.99
• Xbox Live 2100 Points Card – £14.99

US Links:

• Xbox Live 12 Month Gold Membership – $49.99
• Xbox Live 3 Month Gold Membership Card – $24.95
• Xbox Live 4000 Points Card – $49.99
• Xbox Live 2100 Points Card – $19.99

I asked if it was a certain type of charge that would be rolled over. This would explain why my web hosting companies had sent me invoicing emails when their charges to my old card were rejected. She said that that information was confidential to prevent people gaming the system.

Personal Banker then got rather shirty and started interrupting me with phrases like “Well, there’s no official policy” when I tried to repeat this back to her for confirmation, so I called the telephone banking team to verify her given reason. According to Barclays Debit Card Services, companies can set up charges based on the first 12 digits of your card number, ensuring that they still get their payments when you change cards. Debit Card Services Woman said that this is what Microsoft would have done, whereas my hosting companies would have been charging the entire 16-digit card number.

Make of that what you will.

One month later, my boyfriend and his flatmate are sick of me sitting on their couch playing TF2 all the time. Also, Mass Effect was released so I got my own Xbox 360 and flew off on the SS Normandy. In the meantime, I had to get a new debit card because the UK banks have moved away from the wish-it-was-two-factor authentication to actual two-factor authentication. I ordered my new debit card and cancelled my Xbox-Live-known card even though it doesn’t technically expire until September 2008.

There isn’t actually an option to move back to Silver membership from Gold in the Xbox 360 interface. I figured that hey, I can’t use the card in shops any more (I actually tried this), so next time Microsoft try to bill me for the Gold Membership, the charge will get rejected and they’ll downgrade me to a Silver. No problem. My home internet connection is too crappy to play TF2 online anyway.

For Christmas, TheFluffyFist kindly gets me a 12 month subscription card to Xbox Live so that when I do resume playing TF2 I don’t have to give them my new card details and be unable to remove the card info later.

In January, I notice in passing that I still appear to have a Gold membership. “Hmm. That’s strange” I say, but since my two-factor authentication device isn’t in the building, I can’t check my accounts. I forget about it.

Fast forward two months to tonight – I finally got around to looking at my bank statements in detail. Right there in the middle of the month:

“Payment to Microsoft Axbox [sic] Luxembourg This transaction was for GBP 4.99 at exch rate 1.000″

Arse.

Question 1:

How the hell can they continue charging me every month, even though this card was cancelled in November? I shall speak to my bank tomorrow.

Question 2

Does this mean I have to go through the obligatory 3-phone-call ritual and then wait for my non-valid card to be blacklisted before I can stop paying Microsoft for a service I don’t even use?

FFS!

Finally, I’ve been reading Microsoft’s Privacy Statement, which contains the following extract:

“Personal information collected on Microsoft sites and services may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries or agents maintain facilities, and by using a Microsoft site or service you consent to any such transfer of information outside your country. Microsoft abides by the safe harbour framework as set forth by the US Department of Commerce regarding the collection, use and retention of data from the European Union.”

In other words, data submitted to Microsoft is NOT fully protected by the Data Protection Act (1998). If it were, under the core principle of not keeping information longer than is necessary, you would (probably) have the right to have your credit card details removed from payment methods after going through the multiple phone calls that it takes to persuade Microsoft that you no longer want a Gold membership. (Disclaimer – I am not a lawyer.)

Under the Safe Harbour Agreement there is some mention of having the right to delete information where it is inaccurate in Safe Harbour FAQ 8 – Access but… I don’t know how that is applied. Any ideas?

Update 7th Feb 2009:
The saga is over! Microsoft have now given us the option to remove credit card details through Xbox.com. See Remove Your Credit Card Details from Xbox Live – ONLINE! for details.

So 30 days have now passed since I was called by Xbox support. Have they removed my card details as they promised? Err, no they haven’t.

To be honest I didn’t expect them to have either. Maybe they had their hands full dealing with the rather shoddy provision of Xbox Live since Xmas and forgot about my support call?

It has now been 53 days since I first asked Xbox Live support to remove my credit card details. I’m now wondering if they actually are able to remove my card details? At this rate the card will have expired. Very, very poor service Microsoft.

Check out part I and part II of this ongoing saga.

Update 26th Mar 08: They’ve been removed. I can’t believe it. Microsoft have FINALLY done what I asked them to do over 3 and a half months ago. When I examine my LIVE account on my 360 there are no card details at all! Upon reviewing my LIVE account at http:\\billing.microsoft.com my card details have been flagged as removed (only there for historical purposes) and can’t be used or viewed. About bloody time Microsoft.

Our advice, remove your card details and buy pre-paid cards instead:

• Xbox Live 12 Month Gold Membership plus 1 free month!!!
• Xbox Live 12 Month Gold Membership Card
• Xbox Live 3 Month Gold Membership Card
• Xbox Live 4200 Points Card
• Xbox Live 2100 Points Card

Update 7th Feb 2009:
The saga is over! Microsoft have now given us the option to remove credit card details through Xbox.com. See Remove Your Credit Card Details from Xbox Live – ONLINE! for details.

In my previous post I outlined how to start the process to get your card details removed from Xbox Live. I say start the process, as following my latest conversion with a Microsoft representative, it’s going to take a little bit longer.

So there I was opening my Christmas presents when my mobile phone rang. It was someone from Xbox Live support about my request. Wow, they’re dedicated! We then had a fairly short conversation, in which I reconfirmed that I wanted my card details removed. They were finally going to carry out my request. However, this will take 30 days from the date of this latest call to remove my card details. In addition, I would never been able to use this credit card on Xbox Live again. Apparently, the “very complicated” process (support person’s words, not mine) to remove card details from the Xbox Live servers means that my card is essentially now blacklisted.

I was a little surprised to be called again following my discussion on the 15th Dec 07. As I’d specifically asked not to be called back and for them just to remove my card details. Ho hum. I guess the message was never typed never got though.

Here’s the time line for my support call(s) so far:

• 3rd Dec 07 – Raised original support call to remove card details.
• 4th – 14th Dec 07 – 3 missed calls from Xbox Live support.
• 15th Dec 07 – Phoned Xbox Live support – 30 days to remove card. Recurring Gold subscription stopped. Given new support call reference.
• 19th Dec 07 – 1 missed call from Xbox Live support.
• 25th Dec 07 – Informed that card details will be removed in 30 days, unable to use card again on Xbox Live. Given another new support call reference

With any luck when I post part III it will include the words “my credit card details have finally been removed.” I await this moment with bated breath. Almost….

Update 7th Feb 2009:
The saga is over! Microsoft have now given us the option to remove credit card details through Xbox.com. See Remove Your Credit Card Details from Xbox Live – ONLINE! for details.

A few months ago I decided to purchase a months Xbox Live Gold membership. As you all know this is very easy to do. Enter your credit or debit card details and Microsoft take your money before you can blink. Then you receive the obligatory confirmatory email thanking you for your soul purchase. This email also tells you that your membership will automatically renew and:

For information about changing or cancelling your membership and your membership refund policy, go to www.xbox.com/live/accounts.

However, you can’t cancel your membership or remove your credit card details either via your Xbox dashboard or www.xbox.com/live/accounts. Even when you end up at http://billing.microsoft.com you can only change or add a credit or debit card. There is no facility what-so-ever to remove a payment method or cancel a service. Rubbish.

However, I want to stop my monthly Xbox Live Gold subscription. The only way to do this (at the moment) is by calling Xbox Support. I’ve included all the options you need to select to get you through to the relevant help desk person.

UK Xbox Support – Telephone: 0800 587 1102

• Press 1 – Xbox 360 support menu
• Then press 1 – For Xbox Live including billing enquires menu
• Then press 2 – For the cancel or enquire about your account menu
• Finally press 1 – To speak to someone about cancelling your Xbox Live subscription

After I’d said I wanted to remove my credit card details from my Xbox Live account, I was asked for the following information:

• Name
• Credit/Debit card number
• Address
• Home phone number
• Xbox Live username
• Mobile phone number

I was then given a call reference (no surprises there) and told that my request would be escalated to a special team. A member of this team would contact me (via my mobile number) within 48 hours.

The result of all this. It will take 30 days to remove my credit card details from my Xbox Live account. Yes, 30 days (I asked the help desk person to confirm this, just in case I miss heard, which they did). I find this totally unacceptable. The actual (and time-consuming) process of removing/cancelling your card details was completely glossed over in all the communications I received from Microsoft. I won’t hold my breath for the ability to cancel any subscription via the Xbox 360 dashboard. Somehow I don’t think it’s on Microsoft’s feature list (i.e it won’t make them any money). However, until they add this functionality I will not add my credit card details to my live account again.

Update 1st Jan 08: The task of removing my card details continues in part II and part III.

Our advice, remove your card details and buy pre-paid cards instead:

UK Links:

• Xbox Live 12 Month Gold Membership plus 2 free months – £34.99
• Xbox Live 3 Month Gold Membership Card – £9.99
• Xbox Live 4200 Points Card – £34.99
• Xbox Live 2100 Points Card – £14.99

US Links:

• Xbox Live 12 Month Gold Membership – $49.99
• Xbox Live 3 Month Gold Membership Card – $24.95
• Xbox Live 4000 Points Card – $49.99
• Xbox Live 2100 Points Card – $19.99

Then you won’t have to worry about any credit card details :-)