incident · 1416787200000

Sony Pictures Entertainment Hack

A destructive cyberattack against Sony Pictures Entertainment (SPE) by North Korean state-sponsored actors, resulting in massive data theft and the deployment of wiper malware.

What happened

A group calling itself 'Guardians of Peace' breached SPE's network, stealing terabytes of confidential data, including unreleased films, executive emails, and employee personal information. The attackers then deployed destructive malware that erased data and rendered thousands of computers inoperable, demanding the cancellation of a comedy film depicting the assassination of the North Korean leader.

Technical mechanism

Attackers gained initial access via spear-phishing, stole credentials, and mapped the network. They exfiltrated data and subsequently deployed a custom Server Message Block (SMB) worm and wiper malware that overwrote the Master Boot Record (MBR) and data on infected machines.

Why it matters

The attack was a landmark case of state-sponsored destructive malware used against a private corporation to suppress free speech (the release of the movie 'The Interview'), prompting a direct attribution and policy response from the US government.

Impact

SPE suffered severe operational disruption, massive reputational damage from leaked emails, and financial losses estimated at tens of millions of dollars. The release of 'The Interview' was temporarily canceled and then shifted to digital distribution.

Response

The FBI investigated and officially attributed the attack to the North Korean government. The US government imposed new sanctions on North Korea. SPE rebuilt its IT infrastructure and offered identity protection to affected employees.

Defensive lessons

  • Organizations must prepare for destructive attacks with robust, offline backups and incident response plans.
  • Network segmentation is critical to prevent lateral movement and the widespread deployment of wiper malware.
  • Geopolitical tensions can manifest as cyberattacks against private sector entities.

Evidence register

  1. Department of Justice (DOJ) — North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions (verified)