SQL Injection Breach Exposes 37,103 Sony Accounts with Plain‑Text Passwords
What Happened — A SQL injection flaw in sonypictures.com was exploited, allowing attackers to extract personal data and clear‑text passwords for 37,103 user accounts across Sony’s ecosystem. The breach was publicly catalogued by Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of un‑remediated application vulnerabilities—a core control gap that continuous assurance programs must detect and evidence.
- Highlights the need for documented secure‑development lifecycle (SDLC) controls and regular code‑review evidence to satisfy audit requirements.
- Provides a real‑world example of why organizations must maintain defensible proof that vulnerability‑management controls are operating effectively.
Who Is Affected
- Media & entertainment companies that host customer‑facing web applications.
- Any organization that stores passwords without strong hashing, exposing users to credential‑theft risk.
Recommended Actions
- Conduct an immediate application‑security assessment of all public‑facing services.
- Patch the SQL injection vector and enforce parameterised queries or prepared statements.
- Replace clear‑text password storage with salted, iterated hashing (e.g., Argon2, bcrypt).
- Capture remediation evidence (code changes, test results) for audit readiness.
- Review and strengthen your secure‑development lifecycle controls, documenting each step for continuous monitoring.
Source: Have I Been Pwned – Sony breach
Technical Notes
- Attack vector: Vulnerability exploit – SQL injection in sonypictures.com.
- Data types exposed: Names, usernames, email addresses, dates of birth, genders, phone numbers, physical addresses, and passwords (plain text).
- Records affected: 37,103.