SAN FRANCISCO – Sony Corp., besieged by hackers since April, considered its PlayStation Network an unlikely target even after threats by the online collective Anonymous and three separate security incidents in 2008.

The hacker group declared in April that it would wage a cyber war against Sony for trying to stop people from tinkering with the PlayStation 3. Three years earlier, the company faced three breaches in Europe, including one in which Sony said some PlayStation Network user data might have been stolen.

Additional Photos

Sony Computer Entertainment CEO Kazuo Hirai discusses how to use its new PlayStation Portable “NGP” at a Tokyo conference. Since mid-April, a series of breaches has compromised data in more than 100 million online accounts. 2011 Associated Press file

The repeated incidents should have warned Sony that its online network was vulnerable, said Eugene Spafford, a computer science professor at Purdue University in West Lafayette, Ind. The failure to enact safeguards such as appointing a single chief of security may show Sony misunderstands the risks inherent in CEO Howard Stringer’s networked strategy, he said.

“The evidence we’ve seen so far speaks to a lack of a good data management plan and a good security plan,” said Spafford, who specializes in information security, computer crime investigation and information ethics.

JAPAN MINISTRY WARNINGS

Japan’s Ministry of Economy, Trade and Industry said Friday it told Sony to carry out preventive measures against data breaches, instructed the company to ease customer concerns over misuse of credit cards and share more information among affiliates.

Sony has struggled to keep up with the barrage that started in mid-April. The Qriocity and PlayStation Network services were knocked out for almost a month, compromising data in more than 100 million accounts.

In the past week, the Tokyo-based company has been hit with smaller intrusions — a breach at online-service unit So-net Entertainment Corp. led to the misuse of user names and passwords of 128 customers. This week, Sony shut Web pages that were targeted in Greece, Canada, Thailand and Indonesia.

The PlayStation Network will resume in Japan, Taiwan, Singapore, Malaysia, Indonesia and Thailand today, while services in South Korea and Hong Kong will remain suspended until further notice, Sony said Friday.

“Obviously our network security didn’t stop the attack and we’re trying to understand why, and we’ve made big strides in bolstering our security,” Stringer said in a May 17 interview, before the most recent incidents.

Sony believed it had “good, robust security,” Stringer said. He rejected suggestions that Sony is paying for a lack of vigilance and said he was unaware of the 2008 intrusion on the PlayStation Network.

Since most users of PSN don’t pay, and most threats focus on stealing credit card information, the theft of passwords and other personal data from those services appeared less likely, Stringer said.

“We have a network that gave people services free,” Stringer said. “It didn’t seem like the likeliest place for an attack.”

When the April incursion first started, he didn’t know how serious it was, Stringer said. “I really don’t think I could apologize for not knowing,” he said. “It’s a whole new experience for everybody at this scale.”

‘ANONYMOUS’ STRIKES

There were warning signs. Sony was singled out for retaliation by Anonymous, the hacker group that brought down the websites of MasterCard in December, after the company sued George “GeoHot” Hotz, 21, for posting information on how to modify the PlayStation game console. The case was settled March 31.

Anonymous announced its revenge campaign, “Operation Payback,” on the website anonnews.org. In an early May statement, the group denied involvement in the PlayStation and Qriocity breaches, while saying some members of the loosely organized collective may have been behind it.

Sony, Japan’s largest consumer-electronics exporter, must connect its televisions, Blu-ray players, game consoles and digital cameras via the Internet to music, movies and video games, Stringer has said. Unconnected devices rapidly become commodities as rivals compete for customers, he has said.

Sony’s investigation into the cause and search for suspects in the mid-April attack is ongoing, the company said. Sony on Monday said it may spend more than $170 million related to the hack. The company also said it discovered personal data may have been stolen from 8,500 user accounts in a music entertainment site in Greece.

The company erred in “thinking of these incidents in terms of a breach of systems” and communicating with its customers based on the severity of the failure, said Kevin Kosh, a partner at Waltham, Mass.-based Chen PR, which represents technology companies.

“When you’re a consumer-facing organization, that’s not the way you should think,” Kosh said. “It’s first and foremost a business failure and a failure of trust.”

MISSING THE SIGNALS

In the weeks leading up to the April 16 breach, Sony missed key opportunities to plug holes in its system, said Bret McDanel, a security expert who monitored publicly available server logs.

The company’s network security should have seen a sustained probing of its systems from a Navy medical computer in Southern California, which may have been used as a proxy server by potential attackers, McDanel said.

The company hasn’t turned up evidence of such a probe of its servers, said a person with knowledge of Sony’s efforts to trace the security break.

“The truth is that people test for vulnerabilities on network systems on a daily basis, and Sony is constantly monitoring for unauthorized activity, conducting our own vulnerability tests and making constant enhancements,” Race said.

He declined to say whether Sony found evidence of a probe from the Department of Defense server. Justin Cole, a spokesman for the Navy, didn’t return a call requesting comment.

The April attack was launched through a server rented from Amazon.com’s cloud-computing service, a person with know-ledge of the matter said this month. The account was shut and Amazon’s servers weren’t compromised, the person said.

Sony’s chief information officer oversaw network security as part of his duties until after the April attacks. A chief information-security officer was then appointed, reporting to the CIO, to provide another layer of security, the company said.

Failing to take such a step earlier was a critical shortcoming, according to Chen PR’s Kosh.

“Adding a CISO after the fact is like hiring a bodyguard after you’ve been fatally wounded,” Kosh said.

Related Stories