Sony agrees to $15M settlement in 2011 data breach class action [update]

Sony today agreed to a $15 million preliminary settlement in a class action lawsuit over its 2011 data breach, which led to the theft of names, addresses and possibly credit card data belonging to 77 million user accounts.

The security breach took place in April 2011 and shut down Sony’s PlayStation Network for several weeks. The company publicly apologized for the breach in May of that year and offered PSN users free games, but this wasn’t seen as enough for some customers who sought a class action lawsuit. Authorities in the United Kingdom also fined Sony £250,000 ($396,000) for a “serious breach of the Data Protection Act.”

“If you are responsible for so many payment card details and log-in details, then keeping that personal data secure has to be your priority,” the Information Commissioner’s Office’s deputy commissioner David Smith said. “In this case that just didn’t happen, and when the database was targeted — albeit in a determined criminal attack — the security measures in place were simply not good enough.”

Today’s settlement, which has yet to be approved by the judge, offers plaintiffs benefits such as free PlayStation 3 and PlayStation Portable games, free PS3 themes, free subscriptions to PlayStation Plus, free subscriptions to the Music Unlimited service and free SOE Station cash.

Claims made by those who didn’t participate in PlayStation’s “Welcome Back” package — a program in which Sony offered PSN members free games as thanks for their loyalty after the security breach — will be honored on a first-come, first-serve basis, subject to an aggregate cap of $6 million. Claimants will be able to choose two separate benefit options or two instances of one PSN benefit option.

Those who did participate in the “Welcome Back” package will be eligible to receive one game benefit, a theme benefit or a PlayStation Plus subscription benefit. Participants will also be honored on a first-come, first-serve basis to an aggregate cap of $4 million.

Qriocity account holders who did not have a PSN account at the time of the intrusions are eligible to receive one free month of Music Unlimited service, which currently costs $4.99 per month.

SOE claimants are eligible to receive $4.50 worth of “station cash” to be credited to the claimant’s account.

The final fairness hearing, in which a judge will assess the reasonableness of the outcome, will be held May 1, 2015.

Update: Sony officials responded today saying they still deny the allegations.