Sony settles over data lost in hack

Sony Pictures Entertainment has settled a class action suit from nearly 50,000 current and former employees whose personal data was exposed in a breach last year.

The filing does not detail how many people will be covered or the terms of the settlement.

At least 10 former employees have sued the film studio for allegedly failing to protect their private data, which included financial and medical information, as well as senior executives’ email correspondences.

In one complaint, former director of technology Lionel Felix cited previous hacks on the company’s PlayStation system, as well as an audit that found significant flaws in Sony’s security systems.

{mosads}Other employees accused the studio of being more concerned with guarding its public image than protecting its employees from identity theft.

“Following the breach, SPE has focused on its own remediation efforts, not on protecting employees’ sensitive records or minimizing the harm to its employees and their families,” the complaint reads. “Rather, SPE has focused on securing its own intellectual property from pirates and a public relations campaign directed at controlling damage to SPE associated with the release of embarrassing internal emails.”

A district judge granted the plaintiffs standing after they claimed they began to receive threatening emails exploiting their exposed information.

Although the White House blamed the attack on North Korea, allegedly a retributive hit for the comedy film “The Interview,” private companies are increasingly facing their own form of retribution for hacks.

Last month, the U.S. Court of Appeals for the Third Circuit ruled unanimously that the Federal Trade Commission (FTC) can go forward with a lawsuit alleging Wyndham Worldwide Corp. did not do enough to safeguard its customers’ personal data.

The hotel chain suffered three major breaches between 2008 and 2010, resulting in the theft of credit card information for more than 600,000 customers.

The ruling codified an authority over cybersecurity that the FTC had already assumed in practice, sparking complaints from critics who say the agency is unfairly punishing companies that have been victimized by hackers.

Ashley Madison, the infidelity website whose clients saw their personal data laid bare last month, faces at least four U.S. lawsuits seeking class action status. Like Sony, Ashley Madison’s data was targeted not for commercial resale but as retribution for company practices hackers found distasteful.

The fallout from the hack continues to haunt Sony. Earlier this week, The New York Times published a review of exposed emails that tried to demonstrate Sony watered down an upcoming film about concussions in football to placate the NFL.