So the real criminals are not Sony, and the only real victim here is Sony, and the reason we're discussing Sony's responsibilities is because it's "more fun"... got it, thanks for clarifying that.
I'll try to clarify what I said above.
All the "wow" and "I'm at loss" comments seem to take my comments from a "morality" perspective. In short, answer the question "Who's fault is this?". I'm not. I don't care.
I'm being practical.
Who is damaged by this situation (which is what I base my definition of victim on)?
1. Users. No, not really. Credit card services are covered by insurances. The percentage of users who will be victim of CC scams will be minimal. The percentage of those will not be refunded will be absurdely low. You should easily notice because people is being warned by their *banks* about the scams. CC scams are almost impossible to get away with. You need to do isolated operations, in different locations and so on.
Sure, you may need to make a few phone calls, and possibly wait for a new card. But if you feel you're more damaged than...
2. Insurances. These guys will pay for all the virtual money scammers are going to spend. And they're not gonna be happy. And the banks they work with won't either. And they will all go after....
3. Sony. These guys will lose millions. Over redoing PSN, over restoring data, over contracts with insurances, over people sueing them, over investigations, and then there's the image damage.
Once again, be practical. We'll cry and scream over the net for a few days, we'll make some phone calls, but we will be
fine. And 99.9999% of those 75 million people will come out of this without having lost a pence.
Will Sony be fine? I suspect they'll survive, but they'll take a huge hit, in their wallet, for real. And that makes them the "victim". Who isn't the guy who did or did not "had it coming" - it's the guy who gets hurt, no matter what.
As for the "outrageous" conspiracy theory that wow'ed people, I don't find it unrealistical at all. Whoever did this wanted to hit Sony, through its customers. You want to milk some CC? You steal 100, 1000 of them, from different databases, as silently as you can, and be careful about it. If you really expect anyone to make any serious money out of doing something so incredible that it made it on the headlines in a matter of hours, you're crazy. The entire internet transaction system is on Defcon 5 right now.
I'm trying to be rational here. Whoever was smart enough to take down PSN and get that kind of data is probably smart enough to know that trying to use that to an extent proportionate to the amount of data collected would be suicide. The most logical explanation is that someone wanted to hurt Sony, and Sony did plenty to piss off the hacking community lately.
