A Brief History of Cybercrime and Cyberwarfare - The Technical and Social History of Software Engineering - page 383

• On April 20, 2011, Sony was hacked and about 77 million PlayStation ac-
counts were stolen. About 12 million unencrypted credit cards were part
of the stolen data. Home addresses and email addresses were also stolen.
• In 2007, all internet service in the country of Estonia was shut down for
two weeks. This included services to government sites, banks, newspa-
pers, television, radio, hospitals, businesses, schools, and everything else.
This attack was orchestrated from Russia and was apparently triggered by
the removal of a statue of a Russian soldier from Tallinn on April 27,
2007. Sophisticated hackers sent out messages asking for help in a denial
of service attack, complete with instructions. These messages stirred up
hundreds of “script kiddies,” or novice hackers. May 9, the anniversary
celebrated in Russia as the end of the war against Germany, would be the
date of the attack. The basic message for the world is that the internet is
the fastest and most powerful tool for social action in human history.
• In July 2011, a South Korean company called ESTSoft was hacked and
lost about 35 million records, which made up more than half of the total
South Korean population. Apparently, this theft was by hackers in China
because Chinese IP addresses were identified. The stolen data included
names, addresses, phone numbers, user identifications for software, and
passwords.
• In mid-2009, Google and other companies in California were hacked, ap-
parently by the Chinese government. This attack exploited a weakness in
Internet Explorer. The purpose of the attack was not clear but might pos-
sibly have been to identify Chinese subscribers who might oppose the
government.
• In 2010, the VeriSign security company was hacked. It is bad news when
a security company is penetrated. In this case, the news is even worse.
VeriSign did not announce the theft or even notify anyone until 2011
when the Securities and Exchange Commission (SEC) mandated notifica-
tion of security breaches. VeriSign has not yet disclosed what was stolen.
Because VeriSign is the registry for .com and .net internet names, un-
known theft of data is troubling. Part of the VeriSign business was ac-
quired by Symantec in 2010, making it even more difficult to determine
what was stolen.
• In August 2006, American Online (AOL) accidentally exposed records of
650,000 customers on one of its own websites. These data were intended