2014Wiper / destructiveData breach
Sony Pictures Entertainment attack
November 2014
Attackers calling themselves the Guardians of Peace stole large amounts of internal data from Sony Pictures, leaked unreleased films, emails and employee information, and destroyed data on thousands of company computers with wiper malware. The attack came before the planned release of a comedy film about North Korea's leader.
- Victim
- Sony Pictures Entertainment
- Sector
- Media and entertainment
- Public attribution
- The FBI stated in December 2014 that the North Korean government was responsible. In 2018 the US Department of Justice charged a North Korean programmer over this and other attacks.Lazarus Group profile
Impact
Widespread destruction of company systems, public release of confidential data and serious business disruption (FBI).
Root cause
A long undetected intrusion that allowed bulk data theft and deployment of destructive malware across the network.
Lessons learned: the controls it teaches
- Plan for destructive attacks: offline backups and the ability to rebuild endpoints at scale.
- Detect bulk data staging and exfiltration.
- Prepare crisis communications for leaks of sensitive internal data.