The 23-Day PlayStation Network Blackout
On April 20, 2011, Sony shut down PlayStation Network (PSN) after discovering one of the largest data breaches in history. The network remained offline for 23 days, affecting 77 million user accounts and exposing personal information including names, addresses, email addresses, birthdates, PSN passwords, and potentially credit card data.
The Breach Discovery
Hackers exploited vulnerabilities in Sony’s infrastructure to access PSN servers. Sony initially announced “external intrusion” on April 22 but didn’t confirm the scale of data compromised until April 26—six days after the breach. The delayed disclosure sparked outrage, with security experts and government officials criticizing Sony’s slow response.
Investigation revealed that personal data had been stored in unencrypted format and that credit card information may have been accessed, though Sony maintained credit card data was encrypted. The breach affected PlayStation 3, PSP, and Qriocity music streaming users.
The 23-Day Outage
PSN remained completely offline from April 20 to May 14, 2011. PlayStation 3 owners couldn’t play online multiplayer, download games, stream Netflix, or access any network features. New PS3 consoles were essentially offline-only devices. The timing coincided with major releases like Portal 2 and Mortal Kombat, whose online modes were unavailable to PS3 players.
Xbox Live mocked Sony with an ad showing a working online network. Some users switched platforms entirely. Sony lost an estimated $171 million from the outage.
The Aftermath & Compensation
When PSN returned on May 14, Sony offered the “Welcome Back” program: two free PS3 games, two free PSP games, 30 days of PlayStation Plus, and identity theft protection services for affected users. The company faced multiple class-action lawsuits and regulatory investigations in the US, UK, and Japan.
Sony implemented massive security overhauls, hired chief information security officer Philip Reitinger, and spent hundreds of millions on infrastructure improvements. The incident taught the gaming industry that online service security wasn’t optional—it was existential.
Source: Sony official statements, FBI investigation reports, security firm analyses