Support NeoGAF

[adamsapple]

https://insider-gaming.com/sony-playstation-accounts-are-reportedly-being-hacked-with-ease/

Reports are flooding in that PlayStation users are allegedly having their PSN accounts hacked, and the workaround for this is worryingly easy, which could be something Sony needs to address immediately.

A flood of Sony and PlayStation news has hit the headlines as of late: PlayStation is exploring the revival of older IPs, and PlayStation Plus' price is increasing.

These points, both good and bad, pale in comparison to the idea that your PSN account could be compromised at any minute.

PlayStation Security Issue Is Endangering All PSN Accounts

Awareness of the issue first came to light when Colin Moriarty, the self-proclaimed 'The Godfather of PlayStation podcasts', posted on X about a message exchange he had.

The former IGN Editor and founding Kinda Funny member, Moriarty, was given an eye-opening message from a user (who was also hacked). saying: 'Colin, I'm just warning you, they have your information and they are going to try and take your account today.'

This came to fruition, and Moriarty's account was hacked.

Thankfully, after using his PlayStation contacts, he's been able to retrieve his account, but not all may be as fortunate.

On X, @mrpyo1 shared some details discussing the incredibly small amount of details required to infiltrate a PSN account right now:

• Only your PSN ID and one piece of old transaction data are needed by the hacker.
• The hacker then contacts Sony support and provides the information as "proof of ownership."
• Sony's support system then bypasses standard protocols and lets the hacker change the email address linked to the account.
• This also disables 2FA.

There are other examples of this, but Moriarty is likely considered a more high-profile target, and it probably doesn't help that he has his PSN ID in his X bio.

If you do something similar, you might want to consider hiding this information.

We're waiting on Sony to respond to this turn of events.

This is an alarming development, and it's incredible how often Sony accounts and services are targeted. Let us know if you have any issues with your PS account via the Insider Gaming Discord.

 

[Draugoth]

So it seems

• Sony internal security has been compromised
• They were able to social engineer their way into getting the account (happened to me before)

Either way folks, avoid posting your biometric or sensitive data on the internet.

 

[Kacho]

 

[Puscifer]

Also mind you Colin said he got it back due to insiders at Playstation, sounds like you're fucked if you're a regular customer.

 

[LordCBH]

PlayStation security never changes, I see.

 

[Bojji]

That was the old Sony. Current Sony:

 

[Ass of Can Whooping]

Lol. Lmao, even

I remember ages ago when I was trying to recover an account I only needed to give CS the PSN account name to get back into it.

 

[Zacfoldor]

What the fuck!

 

[LordCBH]

That was the old Sony. Current Sony:

Things I wish I could say over work emails to unreasonable clients lol

 

[GrayChild]

I'm sure the increased PSN prices will help Sony to improve their security.

Right.....?

 

[adamsapple]

The fact that the method described above bypasses and even disables 2FA is the scariest thing.

 

[dorkimoe]

I'm sure the increased PSN prices will help Sony to improve their security.

Right.....?

Stability fix update coming soon

 

[Fake]

The future is digital they said.

 

[diffusionx]

When I lost my information with my Blizzard account with 2FA turned on, I had to send them a picture of my ID to get it back. It's annoying and frustrating but if you loosen that, you undermine the whole point of 2FA.

The idea that Sony will disable 2FA based on four digits of a credit card number is crazy.

 

[LordCBH]

The fact that the method described above bypasses and even disables 2FA is the scariest thing.

100%. Last time I had a problem with my blizzard account, they wanted the original product key I used to activate WoW like 20 years ago + a picture of the key itself. At the time I thought "bruh" but now I'm wholly on board with that.

At the very very least PlayStation should require the SN of an active PlayStation product (ideally with a picture of it too) on your account in order to start the account recovery process. If you don't have one then I'm sure other secure ways could be facilitated too.

 

[Zacfoldor]

Guys, is it possible that Nintendo has better cybersecurity than Sony, or do we have a industry wide problem here?

 

[VGA-Games]

This is Unacceptable!!!

 

[LordCBH]

Guys, is it possible that Nintendo has better cybersecurity than Sony, or do we have a industry wide problem here?

Depends. I can't remember if Nintendo supports passkeys or not. But if the issue with PlayStation is a bad actor internally…..or even a bad actor at some outsourced call center in India……

 

[Topher]

News Community Clickbait  Thread 'PlayStation Network Accounts Can Be "Hacked" Even If Protected by 2FA, Passkey'

Dec 24, 2025

Boy oh boy, we've got some trouble. Not a hack per se but user carelessness combined with PlayStation's lack of vigilance could lead to your account being relatively easily stolen:

[Update - December 23 - 10:28 am] In the promised follow-up report, Numerama's Nicolas Lellouche confirmed that the fatal security flaw with Sony's security systems lies in how the account ownership is verified.

Hackers managed to hack the journalist's PlayStation Network account twice using a transaction number, which was asked as proof of account ownership, a number that was obtained via a screenshot...

• TheDarkPhantom
• Replies: 113
• Forum: Gaming Discussion

 

[LordCBH]

News Community Clickbait  Thread 'PlayStation Network Accounts Can Be "Hacked" Even If Protected by 2FA, Passkey'

Dec 24, 2025

Boy oh boy, we've got some trouble. Not a hack per se but user carelessness combined with PlayStation's lack of vigilance could lead to your account being relatively easily stolen:

[Update - December 23 - 10:28 am] In the promised follow-up report, Numerama's Nicolas Lellouche confirmed that the fatal security flaw with Sony's security systems lies in how the account ownership is verified.

Hackers managed to hack the journalist's PlayStation Network account twice using a transaction number, which was asked as proof of account ownership, a number that was obtained via a screenshot...

• TheDarkPhantom
• Replies: 113
• Forum: Gaming Discussion

PlayStation why oh why wouldn't you ask for an active console SN that's tied to the account?! Why!

 

[Fake]

Stop complaining and use your ID. /s

 

[Elios83]

Umm so it's a case of social engineering made possible by sharing online transactions data showing last digits of your own cc?

How is this "easy" unless you get your mail hacked or are stupid enough to share these details by yourself?

They could instruct their employees to require stricter requirements to be allowed to recover lost accounts but that's a double edged sword since you might be required to share your ID or other personal documents.

 

[LordCBH]

Umm so it's a case of social engineering made possible by sharing online transactions data showing last digits of your own cc?

How is this "easy" unless you get your mail hacked or are stupid enough to share these details by yourself?

They could instruct their employees to require stricter requirements to be allowed to recover lost accounts but that's a double edged sword since you might be required to share your ID or other personal documents.

At the very least PlayStation support should be able to see if a console has been active on your account in the past few months and should ask you for the serial number from it. Could even go farther and want a picture of the serial on the console itself.

 

[Three]

Depends. I can't remember if Nintendo supports passkeys or not. But if the issue with PlayStation is a bad actor internally…..or even a bad actor at some outsourced call center in India……

Both PSN and NSO support passkeys.

If the attack vector was support it's just social engineering and identity theft for a targeted attack. It's not that easy unless the guy is famous and has public information out in the wild. the alternative is innocent people being locked out of their accounts who have forgotten their credentials. Guy got his account back and hacker wasted his own time for some needless fraud. This isn't that big a deal in the end but it's a nuisance for those targeted.

They should just add a delay to a password/email change, send an email to your registered account even if the person calling is claiming they've lost access to that email and then give the person some time to reject the change if it's not them. Unless the persons email itself is compromised then it should prevent this type of fraud.

 

[LordCBH]

Both PSN and NSO support passkeys.

If the attack vector was support it's just social engineering and identity theft for a targeted attack. It's not that easy unless the guy is famous and has public information out in the wild. the alternative is innocent people being locked out of their accounts who have forgotten their credentials. Guy got his account back and hacker wasted his own time for some needless fraud. This isn't that big a deal in the end but it's a nuisance for those targeted.

They should just add a delay to a password/email change, send an email to your registered account even if the person calling is claiming they've lost access to that email and then give the person some time to reject the change if it's not them. Unless the persons email itself is compromised then it should prevent this type of fraud.

Theoretically, could PlayStation implement a push a notification of the attempted change to the PlayStation mobile app on your phone or as a notification to the console if you're already signed in and online? With an option to decline the change?

 

[mdkirby]

And yet every man and his dog are now demanding we hand over our passports and faces to verify age, either through vulnerable systems they implement themselves or through larger but still vulnerable centralised systems.

It won't be long until everyone is running around with copies of people's official ID to even more effectively compromise these systems.

 

[Three]

Theoretically, could PlayStation implement a push a notification of the attempted change to the PlayStation mobile app on your phone or as a notification to the console if you're already signed in and online? With an option to decline the change?

That's also a good idea. They should be able to if the person hasn't disabled notifications for the app.

 

[reinking]

Lol. Lmao, even

I remember ages ago when I was trying to recover an account I only needed to give CS the PSN account name to get back into it.

You can't get that kind of customer service these days. Now everyone is like, prove it. I just want to get back to my games man.

 

[Jam Dingo]

It's absolutely incredible that they would let someone hijack an account just with a transaction ID. FFS that's insane. I know there needs to be some way of recovering an account, but there are all kinds of additional checks they could be making. What about asking for a credit card linked to the account? Or logging the person out and prompting them to log back in, and then giving them 24 hours or something to do that? It's just unforgivable to have this kind of weakness when people are spending thousands on their accounts.

 

[Moondoggy]

What a joke that all they need to trick the trash ass support system is the PSN ID and the last 4 digits of a card that's been used on the account at any point in the past.

 

[cormack12]

If this was true adam, you'd be able to provide me with a transaction ID to prove it. Can I has?

 

[Hypereides]

The future is digital they said.

This is one of the major, and mean major, reasons people should really be apprehensive about the digital future. Many of these big companies didn't take security into account once they fully transitioned their operations onto the net.

When I lost my information with my Blizzard account with 2FA turned on, I had to send them a picture of my ID to get it back. It's annoying and frustrating but if you loosen that, you undermine the whole point of 2FA.

The idea that Sony will disable 2FA based on four digits of a credit card number is crazy.

Just scored Diffusionx's ID fresh off a data dump at a darkweb forum. Here it is:

Spoiler: Diffusionx's totally legit driver's license

 

[mayham2199]

PlayStation security never changes, I see.

When looking into this apparently Steam also had this issue but they made changes after discovering it.

 

[Fake]

This is one of the major, and mean major, reasons people should really be apprehensive about the digital future. Many of these big companies didn't take security into account once they fully transitioned their operations onto the net.

And they still want your ID somehow.

 

[CentralScrutinizer]

Sony should raise the price os PS+ again to pay for employees to create basic features that should be free to any ecosystem that harvests user data.

It's a shame Sony can't afford to do this. A pity really.

 

[GrayChild]

Lol. Lmao, even

I remember ages ago when I was trying to recover an account I only needed to give CS the PSN account name to get back into it.

What's your PSN account name btw? Just asking.

 

[xrnzaaas]

Sony shouldn't be so quick with changing the email based only on PSN ID & transaction data. How about sending an e-mail to the original account, a text to your linked phone or a notification through the PlayStation app? You know, to make sure that this person actually needs to make a change?

 

[midnightAI]

This isn't a hack though is it?

 

[mckmas8808]

PlayStation security never changes, I see.

Yeah this isn't good.

 

[Cert.in.Death]

Sounds like someone who signed the training session affidavit is in for a spanking.

 

[Kuranghi]

Sony would sooner get a picture of my cock than one of my face/ID at this point. Its prettier anyway.

So does have that passcode shite on stop them from getting access or is that covered under 2FA?

 

[DEAD ORIGINAL]

What I find crazy is why anyone would have there credit card or debit card saved to there PSN account, I use Shopto PSN cards.

 

[Unknown?]

Umm so it's a case of social engineering made possible by sharing online transactions data showing last digits of your own cc?

How is this "easy" unless you get your mail hacked or are stupid enough to share these details by yourself?

They could instruct their employees to require stricter requirements to be allowed to recover lost accounts but that's a double edged sword since you might be required to share your ID or other personal documents.

Yeah, it's not "easy" per say but a hole that needs to be filled. Also this is not hacking...

 

[LordCBH]

What I find crazy is why anyone would have there credit card or debit card saved to there PSN account, I use Shopto PSN cards.

 

[ReyBrujo]

Yeah, same old issue that has been happening for years already. That was my first thought yesterday when they posted about this guy's hack. It only happens with idiots posting their transaction ids online. And just as people posting QRs for concerts in pics online, well deserved.

Sony shouldn't be so quick with changing the email based only on PSN ID & transaction data. How about sending an e-mail to the original account, a text to your linked phone or a notification through the PlayStation app? You know, to make sure that this person actually needs to make a change?

Then you lose your account to a hacker and won't be ever be able to get it back since they will deny all charges and will require much more manpower to check who is telling the truth. Also the system is not AI-scalable which is what every company wants nowadays.

 

[Jagernaut]

Umm so it's a case of social engineering made possible by sharing online transactions data showing last digits of your own cc?

How is this "easy" unless you get your mail hacked or are stupid enough to share these details by yourself?

They could instruct their employees to require stricter requirements to be allowed to recover lost accounts but that's a double edged sword since you might be required to share your ID or other personal documents.

Who posts their transaction details online? Why would you?

 

[TintoConCasera]

And people were wondering why nobody on PC wanted to sign up for PSN to play Helldivers 2.

 

[neo raider]

Its not just that u get a transaction receipt and you'll get an account that easily
Its more like u get in touch with someone from the inside
I genuinely thought everybody knew about the corrupt PlayStation admins that were selling not only accounts but also very sensitive data like card details/phone numbers/ip addresses/hardware serial number and addresses

Do I think sony would do anything? HELL NO

And to touch back on stealing accounts, PlayStation employees that had access to accounts used to only sell inactive, non high profile accounts that had rare usernames.
Now days they dont care, they'll sell anything for the right price

 

[CentralScrutinizer]

Its not just that u get a transaction receipt and you'll get an account that easily
Its more like u get in touch with someone from the inside
I genuinely thought everybody knew about the corrupt PlayStation admins that were selling not only accounts but also very sensitive data like card details/phone numbers/ip addresses/hardware serial number and addresses

Do I think sony would do anything? HELL NO

And to touch back on stealing accounts, PlayStation employees that had access to accounts used to only sell inactive, non high profile accounts that had rare usernames.
Now days they dont care, they'll sell anything for the right price

Hopefully, since this happened to a high profile figure / journalist, there's actually some investigative journalism going on to reveal whats really going on if this is true. Hopefully Colin doesn't just drop this.

 

[semiconscious]

News Community Clickbait  Thread 'PlayStation Network Accounts Can Be "Hacked" Even If Protected by 2FA, Passkey'

Dec 24, 2025

Boy oh boy, we've got some trouble. Not a hack per se but user carelessness combined with PlayStation's lack of vigilance could lead to your account being relatively easily stolen:

[Update - December 23 - 10:28 am] In the promised follow-up report, Numerama's Nicolas Lellouche confirmed that the fatal security flaw with Sony's security systems lies in how the account ownership is verified.

Hackers managed to hack the journalist's PlayStation Network account twice using a transaction number, which was asked as proof of account ownership, a number that was obtained via a screenshot...

• TheDarkPhantom
• Replies: 113
• Forum: Gaming Discussion

thanks for this...