Loading story…
Sony Pictures Entertainment suffered a destructive cyberattack that leaked internal emails and documents, disrupted operations, and intensified after the studio's planned release of The Interview, a film depicting the assassination of North Korean leader Kim Jong Un. A group calling itself Guardians of Peace claimed responsibility, and US officials publicly attributed the intrusion to North Korea, with FBI Director James Comey later saying the attackers exposed themselves by sending messages through internet infrastructure used exclusively by North Korea. ABC also reported that investigators believed parts of the operation were routed through compromised computers overseas, underscoring the attackers' efforts to obscure their origin.
The attribution quickly became contested as private-sector researchers and cyber intelligence firm Norse briefed the FBI on an alternate theory pointing to disgruntled former Sony employees and piracy-linked hackers rather than Pyongyang, while the FBI said it had no credible evidence contradicting its conclusion. The fallout expanded beyond the initial breach when WikiLeaks published more than 170,000 emails and 30,000 documents taken in the attack, prompting Sony to denounce the release as trafficking in stolen, private, and privileged material. Separate reporting on the celebrity photo theft involving Jennifer Lawrence and others showed the FBI simultaneously confronting another high-profile case of hacked private content being widely redistributed online, highlighting the broader climate of major entertainment-sector cyber intrusions and privacy violations.
See attribution, scope, and your downstream exposure.
12 events from the most recent confirmed update back to the earliest known activity.
US authorities announced criminal charges against a North Korean operative for his alleged role in the Sony Pictures hack, the WannaCry ransomware outbreak, and related cyberattacks. The action marked a law-enforcement escalation beyond earlier public attribution of the Sony breach to North Korea.
Sony Pictures denounced WikiLeaks for publishing the stolen company data, calling the materials private, privileged, and unlawfully obtained. The company said the release compounded the harm caused by the 2014 cyberattack.
WikiLeaks released more than 170,000 emails and 30,000 additional documents stolen in the Sony Pictures hack. The publication extended the impact of the breach months after the initial intrusion.
FBI Director James Comey said the Sony attackers made operational security mistakes and that some communications to Sony employees came from internet connections used exclusively by North Korea. He presented the details publicly to bolster the FBI's attribution case.
Cyber intelligence firm Norse briefed FBI investigators on an alternative theory that the Sony attack may have involved laid-off Sony employees and piracy-linked hackers rather than North Korea. The FBI said it had no credible information supporting another culprit.
At a White House briefing, Press Secretary Josh Earnest said the Sony hack was being investigated by the FBI and the Defense Department's National Security Division as a serious national security matter. He said the destructive attack warranted an appropriate US response, while declining to confirm attribution details publicly.
US intelligence officials and the FBI publicly attributed the Sony Pictures attack to North Korea. The attribution became a central and disputed development in the aftermath of the breach.
Sony Pictures, through attorney David Boies, sent letters warning media outlets against publishing information from documents stolen in the company hack. The move marked an early legal response by Sony as hacked emails and files began circulating publicly.
Sony Pictures Entertainment suffered a major cyberattack claimed by a group calling itself Guardians of Peace. The breach led to theft of emails and internal documents and became tied to controversy around the film 'The Interview.'
Reddit banned subreddits associated with 'The Fappening' after they had become major hubs for sharing the hacked celebrity photos. The move reflected platform-level action against distribution of the stolen material.
The FBI confirmed it was addressing the leak of celebrities' private photos, signaling a federal law enforcement response to the incident. The statement came as the stolen images spread across online platforms.
Private photos of numerous celebrities, including Jennifer Lawrence, were leaked and widely distributed online in what was described as a hacking incident. The leak quickly became a major privacy and cybercrime story.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
11 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcedw.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceabcnews.go.com
Open sourcewashingtonpost.com
Open sourcehuffpost.com
Open sourcecbsnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sony Pictures Entertainment suffered a destructive cyberattack that shut down internal systems, exposed large volumes of confidential data, and led to the online leak of unreleased films, executive emails, contracts, salary information, and employee medical and personal records. The attackers, calling themselves **Guardians of Peace**, reportedly stole roughly 11TB of data and used the breach to pressure Sony over *The Interview*, a comedy depicting a plot to kill Kim Jong Un. The fallout triggered lawsuits from former employees, public embarrassment for senior executives after private emails were published, and major operational disruption as staff reverted to phones, fax machines, and handwritten notes while the company worked with the FBI and other authorities. The intrusion escalated from data theft to coercion when the hackers threatened cinemas with a "9/11"-style attack if *The Interview* was shown, prompting major theater chains to drop the film and Sony to cancel its wide Christmas release before later restoring it through independent theaters and online platforms including YouTube, Google Play, Xbox Video, and Sony's own service. U.S. officials and the FBI publicly attributed the attack to North Korea, later tying it to alleged operative **Park Jin Hyok** and broader Lazarus-linked activity, while North Korea denied responsibility and some private researchers argued insider involvement may also have played a role. The case became a landmark example of cyber-enabled extortion, censorship pressure, and destructive state-linked intrusion against a major media company.
Jun 29, 2026
Sony has been tied to two major security controversies reflected in the referenced reporting: an earlier backlash over rootkit-like DRM software on music CDs, and the later **Sony Pictures** breach that escalated into a national security issue. Archived reporting on the 2014 incident describes a significant compromise of Sony Pictures, while U.S. government reporting indicated the White House viewed the attack as a national security threat rather than a routine corporate intrusion. Follow-on industry analysis and Novetta’s **Operation Blockbuster** reporting said the Sony Pictures attack exposed a deeper, coordinated malware operation and helped drive broader attribution and threat-tracking efforts. Together, the references show Sony as the focus of both a high-profile software security scandal and a destructive enterprise breach, with the latter prompting extensive private-sector investigation into the malware and attacker tradecraft behind the intrusion.
Jun 29, 2026
A series of high-profile cyber incidents disrupted major online platforms, exposed weak security practices, and highlighted the broad impact of both criminal and activist hacking. A global ransomware outbreak later identified as **WannaCry** spread rapidly across organizations before a security researcher slowed it by registering a domain used as a kill switch, while a separate attack briefly knocked major websites offline through distributed denial-of-service activity. In another major case, hackers compromised prominent US Twitter accounts and used them to promote a Bitcoin scam, demonstrating how access to trusted platforms can be weaponized at scale. Other incidents underscored persistent failures in account security and access control. Equifax faced scrutiny after an Argentine employee portal was reportedly protected with the username and password **`admin`**, adding to concerns around the company’s security posture. Apple said some user accounts had been compromised while denying a broader breach of its systems, and the celebrity photo leak known as **“the fappening”** showed how attackers could exploit personal account weaknesses. Separately, US authorities linked Julian Assange to alleged conspiracy with Anonymous-affiliated hackers, activist campaigns targeted recording industry websites, and the Colonial Pipeline ransomware case showed how an intrusion into a critical fuel operator could trigger widespread operational disruption even when attackers later claimed they had not intended such consequences.
Jul 12, 2026