Loading story…
Sony Pictures Entertainment suffered a destructive cyberattack that shut down internal systems, exposed large volumes of confidential data, and led to the online leak of unreleased films, executive emails, contracts, salary information, and employee medical and personal records. The attackers, calling themselves Guardians of Peace, reportedly stole roughly 11TB of data and used the breach to pressure Sony over The Interview, a comedy depicting a plot to kill Kim Jong Un. The fallout triggered lawsuits from former employees, public embarrassment for senior executives after private emails were published, and major operational disruption as staff reverted to phones, fax machines, and handwritten notes while the company worked with the FBI and other authorities.
The intrusion escalated from data theft to coercion when the hackers threatened cinemas with a "9/11"-style attack if The Interview was shown, prompting major theater chains to drop the film and Sony to cancel its wide Christmas release before later restoring it through independent theaters and online platforms including YouTube, Google Play, Xbox Video, and Sony's own service. U.S. officials and the FBI publicly attributed the attack to North Korea, later tying it to alleged operative Park Jin Hyok and broader Lazarus-linked activity, while North Korea denied responsibility and some private researchers argued insider involvement may also have played a role. The case became a landmark example of cyber-enabled extortion, censorship pressure, and destructive state-linked intrusion against a major media company.
See attribution, scope, and your downstream exposure.
19 events from the most recent confirmed update back to the earliest known activity.
The U.S. government moved to charge Park Jin Hyok, an alleged North Korean operative, in connection with the 2014 Sony Pictures hack. The case tied the Sony intrusion to broader North Korean cyber operations, including WannaCry and the Bangladesh Bank theft.
WikiLeaks released a searchable archive of Sony documents obtained from the breach. The publication extended the public exposure of internal Sony emails and files months after the attack.
At a cybersecurity conference in Manhattan, FBI Director James Comey said the Sony attackers made operational security mistakes that exposed internet connections used exclusively by North Korea. He presented the remarks as additional detail supporting the FBI's attribution.
North Korea reacted angrily after the United States imposed sanctions in response to the Sony attack. The sanctions represented a formal U.S. retaliatory step tied to the attribution of the hack to Pyongyang.
Private-sector cybersecurity researchers challenged the FBI's conclusion that North Korea alone was behind the Sony hack, arguing that insider involvement was likely. Reports cited suspected former employees and said some public indicators could have been decoys.
Sony made The Interview available online through YouTube Movies, Google Play, Xbox Video, Sony's platform, and a dedicated website one day before its theatrical debut. The digital release marked a further reversal of the earlier cancellation.
Sony reversed its cancellation and announced that The Interview would be released in more than 300 theaters on Christmas Day, largely through independent cinemas. The move followed criticism that canceling the film had rewarded coercion.
North Korea rejected the U.S. accusation and proposed a joint investigation into the Sony hack. Pyongyang decried the allegations while continuing to deny direct involvement.
President Barack Obama criticized Sony's decision to pull The Interview, saying the company 'did the wrong thing.' His remarks came as the U.S. government publicly blamed North Korea for the hack.
The FBI announced that North Korea was responsible for the Sony Pictures cyberattack. U.S. officials said the attack was linked to the intimidation campaign around The Interview.
Former employees filed lawsuits alleging Sony failed to protect highly sensitive personnel information exposed in the breach. The compromised data reportedly included records on about 47,000 current and former employees.
Sony canceled the planned December 25 theatrical release of The Interview after major theater chains refused to show it following hacker threats. The company also canceled the New York premiere amid the same intimidation campaign.
Top U.S. theater circuits decided not to screen The Interview after the threats tied to the Sony hack. Their withdrawal removed the film from most planned venues and increased pressure on Sony to change release plans.
The Guardians of Peace issued threats warning of a '9/11'-style attack against theaters showing The Interview. The threats escalated the incident from data theft and leaks into coercion aimed at stopping the film's release.
Sony executives Amy Pascal and Scott Rudin apologized after racially insensitive private emails leaked from the stolen Sony data prompted public backlash. Pascal said she was deeply embarrassed and criticized publication of the stolen material.
An email attributed to the Guardians of Peace blamed the attack on Sony's planned release of The Interview and demanded the company stop showing the film. The message also taunted Sony and the FBI as the breach investigation continued.
North Korea publicly denied responsibility for the Sony Pictures hack while criticism mounted over The Interview. A DPRK statement also suggested sympathizers could have carried out the attack.
About a week after the intrusion became public, high-quality copies of several unreleased or recently released Sony films were leaked online. Reports said the movies were likely part of roughly 11TB of data stolen from Sony.
Sony Pictures Entertainment suffered a major cyberattack in November 2014 that forced the company to shut down its computer network and begin working with law enforcement. Later reporting said the destructive phase of the attack became public on November 24, 2014.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
43 references tracked. Mallory keeps watching after this page renders.
bbc.co.uk
Open sourceweb.archive.org
Open sourcefbi.gov
Open sourcetheguardian.com
Open sourceweb.archive.org
Open sourcenpr.org
Open sourcecomputerweekly.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sony Pictures Entertainment suffered a destructive cyberattack that leaked internal emails and documents, disrupted operations, and intensified after the studio's planned release of *The Interview*, a film depicting the assassination of North Korean leader Kim Jong Un. A group calling itself **Guardians of Peace** claimed responsibility, and US officials publicly attributed the intrusion to North Korea, with FBI Director James Comey later saying the attackers exposed themselves by sending messages through internet infrastructure used exclusively by North Korea. ABC also reported that investigators believed parts of the operation were routed through compromised computers overseas, underscoring the attackers' efforts to obscure their origin. The attribution quickly became contested as private-sector researchers and cyber intelligence firm Norse briefed the FBI on an alternate theory pointing to disgruntled former Sony employees and piracy-linked hackers rather than Pyongyang, while the FBI said it had no credible evidence contradicting its conclusion. The fallout expanded beyond the initial breach when WikiLeaks published more than **170,000 emails** and **30,000 documents** taken in the attack, prompting Sony to denounce the release as trafficking in stolen, private, and privileged material. Separate reporting on the celebrity photo theft involving Jennifer Lawrence and others showed the FBI simultaneously confronting another high-profile case of hacked private content being widely redistributed online, highlighting the broader climate of major entertainment-sector cyber intrusions and privacy violations.
Jun 29, 2026
Sony has been tied to two major security controversies reflected in the referenced reporting: an earlier backlash over rootkit-like DRM software on music CDs, and the later **Sony Pictures** breach that escalated into a national security issue. Archived reporting on the 2014 incident describes a significant compromise of Sony Pictures, while U.S. government reporting indicated the White House viewed the attack as a national security threat rather than a routine corporate intrusion. Follow-on industry analysis and Novetta’s **Operation Blockbuster** reporting said the Sony Pictures attack exposed a deeper, coordinated malware operation and helped drive broader attribution and threat-tracking efforts. Together, the references show Sony as the focus of both a high-profile software security scandal and a destructive enterprise breach, with the latter prompting extensive private-sector investigation into the malware and attacker tradecraft behind the intrusion.
Jun 29, 2026
Research tracing the **DarkSeoul** threat cluster has linked the 2014 Sony Pictures Entertainment breach to a longer-running campaign of destructive intrusions that also hit South Korean banks and media companies. The reporting ties the activity to malware families and operational patterns seen across incidents dating back to at least 2009, including the April 2013 **DarkSeoul** attack that crippled tens of thousands of systems with disk-wiping malware. Analysts said the campaign was initially mistaken in some cases for hacktivism, but code lineage, shared tooling, and recurring tradecraft pointed to a coordinated, multi-year operation. The Sony intrusion malware **Destover** was highlighted as part of the same evolving toolkit, with researchers connecting it to broader destructive and espionage activity primarily targeting South Korean organizations across sectors. One analysis said South Korean authorities independently attributed the 2013 attacks to **North Korea**, while another noted that the operators behind the wider cluster were commonly tracked as **DarkSeoul** or **Silent Chollima**, though exact operator identity remained disputed in some reporting. The studies also outlined indicators of compromise and defensive controls that could have reduced the impact of the wiper attacks.
Aug 15, 2026