Dec 16, 2014 1:55 PM
Ex-employees sue Sony Pictures over hacked personal details
The Associated Press
NEW YORK (AP) Two former employees of Sony Pictures Entertainment are suing the company for not preventing hackers from stealing nearly 50,000 social security numbers, salary details and other personal information from current and former workers.
The lawsuit claims that Sony Pictures failed to secure its computer systems despite "weaknesses that it has known about for years," and made a business decision to accept the risk. It states that the latest data breaches are especially "surprising and egregious" because Sony Pictures has been repeatedly attacked over the years, including a 2011 hack that revealed millions of user accounts on Sony's PlayStation video-game network.
The case filed in a federal court in Los Angeles on Monday seeks class-action status for other current and former employees whose personal information was stolen posted online.
Sony did not immediately respond to a request for comment Tuesday morning.
Highly sensitive material from the entertainment unit of Tokyo-based Sony Corp. has been leaked almost daily since hackers broke into its computer networks last month. New threats and data leaks from the shadowy group calling itself Guardians of Peace, or GOP, were issued Tuesday.
The case has two named plaintiffs: Michael Corona, a former Sony Entertainment employee who left the company in 2007 and now lives in Virginia, and Christina Mathis, who left the company in 2002 and lives in California. They allege their Social Security numbers and other sensitive personal information have been leaked, exposing them to identify theft for years to come.
Their lawyers allege that emails and other information leaked by the hackers show that Sony's information-technology department and its top lawyer believed its security system was vulnerable to attack, but that company did not act on those warnings. Corona and Mathis do not spell out how much they are seeking the case, but want actual damages and an order requiring Sony to pay for services to monitor credit and banking services and repair damage from identify theft for at least five years.
Sony has offered employees one year of credit monitoring, the lawsuit states. The plaintiffs claim that protection is inadequate because it can take years for thieves to exploit the personal information included in the data breach.
Corona so far has spent $700 on identity theft protection for him and his family, and Mathis has spent $300, according to the suit.
Legal experts said the case is likely the first of many that will be filed over the data breach. Sony potentially faces tens of millions of dollars in damages from a class-action lawsuit, said Jonathan Handel, an entertainment law professor at the University of Southern California Gould School of Law.
"This is not a 'bet your company' lawsuit but it is a serious matter for Sony both in terms of dollar exposure and public perception of the brand," Handel said. "This doesn't look good for Sony, which after all is a technology company."
In addition to lawsuits from its ex-employees, Sony is likely to face fines from government regulators and lawsuits from actors, producers and directors who may not want to work with the studio anymore, said Steven S. Rubin, a New York cybersecurity lawyer with the firm Moritt Hock & Hamroff.
Among the materials that have been leaked are sensitive emails and studio materials that criticize actors and producers. Those with ongoing contracts with Sony could argue the company has breached their agreement and move their work elsewhere, Rubin said.
"It's devastating. This is killing their reputation," Rubin said. He noted that Sony may be able to get out of this, by investing in a "gold star cybersecurity approach." However, "it's a clear reminder for companies that are smaller than Sony, you don't want this to happen."
McCartney reported from Los Angeles. Business Writer Mae Anderson contributed to this report in New York.