Ex Sony Employees File Class Action Lawsuit Over Hacked Emails

Sony Pictures Entertainment is heading to court to answer for its weak security measures.

A lawsuit was filed in California federal court Monday on behalf of Michael Corona and Christina Mathis, ex-employees at Sony, who worked for the company from 2004-2007 and 2000-2002, respectively. Their complaint alleges they had sensitive information leaked as a result of the hack attack, such as their Social Security numbers, salary history and, in Corona's case, his reason for resigning from the company, which is meant to remain confidential. Corona and Mathis are suing on behalf of themselves and approximately 15,000 individuals who also had their sensitive data compromised by Sony's apparently inadequate security standards.

"An epic nightmare, much better suited to a cinematic thriller than to real life, is unfolding in slow motion for Sony’s current and former employees," the complaint reads. "Their most sensitive data, including over 47,000 Social Security numbers, employment files including salaries, medical information, and anything else that their employer Sony touched, has been leaked to the public, and may even be in the hands of criminals."

"At its core, the story of 'what went wrong' at Sony boils down to two inexcusable problems," the document continues. "(1) Sony failed to secure its computer systems, servers, and databases ('Network'), despite weaknesses that it has known about for years, because Sony made a 'business decision to accept the risk' of losses associated with being hacked; and (2) Sony subsequently failed to timely protect confidential information of its current and former employees from law-breaking hackers who (a) found these security weaknesses; (b) obtained confidential information of Sony's current and former employees stored on Sony's Network, (c) warned Sony that it would publicly disseminate this information, and (d) repeatedly followed through by publicly disseminating portions of the information that they claim to have obtained from Sony's Network through dumps of internal data from Sony's Network."

Further details via The Hollywood Reporter:

The plaintiffs are represented by attorneys at the law firm of Keller Rohrback who are demanding actual and statutory damages, restitution and disgorgement for causes of action that include negligence, health privacy and a California statute requiring notifications of data breaches. They haven't estimated the value of the damages, but they are also demanding equitable relief including forcing Sony to provide credit monitoring for at least five years, identity theft insurance, credit restoration service and requiring Sony receive periodic compliance audits by a third party regarding the security of its computer systems.

The lawsuit is also unusual in nature as it references internal Sony documents exposed in the leak. The plaintiffs are attempting to show that Sony knew about security weaknesses and made a business decision to accept the risks despite previous data breaches. Some of the information from the leaked documents is sourced to news reports like one from Gizmodo said to be reporting that "just two months before the Data Breach became public, Sony released a scathing internal IT assessment. In the report Sony's IT personnel found basic security protocol went unheeded and what little IT security it did have was plagued with unmonitored devices, miscommunication, and a lack of accountability."

Sony general counsel Leah Weil's messages about email retention are quoted as well as those of outside security experts. The lawsuit also recaps past hacking events like the breach of Sony PlayStation user data and how the company reacted in the aftermath.

Of course, the thrust of the argument here is that Sony is protecting its own assets without giving very much consideration to cover its employees. Case in point, Sony has already enacted measures to fight against illegal movie downloads and the dissemination of emails and other sensitive studio documents that have resulted from these leaks. But Corona and Mathis allege the studio has done nothing to combat the threat of "identity theft vulnerabilities and the possibility of such crimes as immigration crime, false driver's licenses and thieves obtaining government benefits and fraudulent tax refunds."

No word on just how much Corona and Mathis are seeking in damages, but one would presume it'd be in the millions -- if only because anything less split 15,000 ways isn't going to amount to much.

Credit: Sony