Sony Pictures Entertainment Hack (2014)

01Summary

The attack commenced in November 2014, following the release of *The Interview*, a comedy depicting the assassination of Kim Jong-un. North Korea condemned the film as an 'act of war,' providing the stated motive for the cyber retaliation. The attackers gained access to Sony's internal network, where they systematically stole vast quantities of data, including unreleased films, executive emails, and employee salary information. Crucially, the operation involved the deployment of wiper malware, which was designed not merely to steal, but to destroy, wiping out approximately 70% of Sony's operational servers and internal systems. The leaked data caused significant public embarrassment, revealing details like gender pay gaps and racially insensitive remarks made by executives, leading to internal corporate turmoil and a major operational shutdown.

02Background

The incident occurred in the context of escalating geopolitical tensions between the United States and North Korea. The film *The Interview* was a highly controversial piece of media, and the subsequent cyberattack was widely interpreted by Western intelligence and media as a direct, state-sponsored act of digital aggression and punitive retaliation.

03Key revelations

01The existence of significant gender pay gaps among top-billed stars at Sony Pictures.
02Racially insensitive and controversial remarks made by high-ranking executives, including Amy Pascal.
03The theft and public release of unreleased, highly valuable film screeners and internal corporate strategy documents.

04Technical analysis

The attackers utilized a combination of data exfiltration and destructive malware. The initial access vector is believed to have been through compromised credentials or a supply chain vulnerability, allowing them to move laterally across the network. The primary destructive tool was a wiper malware, which overwrote critical system files and data, effectively crippling Sony's ability to operate normally for weeks. The exfiltration method involved siphoning data over the internet, while the internal damage required physical workarounds, such as using fax machines, to restore basic operations.

Attack vector: Compromised credentials or network vulnerability (specific initial vector remains unconfirmed, but lateral movement was successful).
Attack method: Destruction and Exfiltration (Wiper Attack and Data Theft)
Initial access: Unknown (Likely compromised credentials or network perimeter breach)
Lateral movement: Internal network traversal
Exfiltration: Internet transfer
Tool / malware: Wiper Malware
Malware family: Wiper
Malware type: Wiper

MITRE ATT&CK techniques

T1486
T1071.001
T1566.001

05Threat actor

The Lazarus Group is a sophisticated, state-sponsored hacking collective widely attributed to North Korea. They are known for their diverse operations, ranging from financial theft and cryptocurrency laundering to destructive cyberattacks, making them one of the most versatile and dangerous cyber threats globally.

Aliases

Guardians of Peace (GOP)
DPRK RGB

APT designations

Lazarus Group

MITRE groups

T1071.001
T1566.001
T1486

Attribution sources

FBI
Reuters
The New York Times

06Victims and impact

Countries affected

07Data exposed

Data types

Executive Emails
Financial Records (Salaries)
Unreleased Films/Screeners
Internal Corporate Communications

Notable documents

Executive Emails (e.g., Amy Pascal's communications)
Unreleased Film Screeners (e.g., Annie, Fury)

08Financial damage

The damage was primarily operational and reputational, requiring significant time and resources to restore core business functions.

09Timeline

2014-11-24The attack begins; data exfiltration and wiper malware deployment.
2014-11-24Leaked data, including salary information and executive emails, is made public.
2014-12-20Sony begins the process of restoring critical systems and operations.

10Key figures

Amy PascalCo-Chair of Sony Pictures · Sony Pictures EntertainmentAmericanPublicly criticized and faced internal fallout due to leaked emails.

11On the record

We have obtained all your internal data including your secrets and top secrets.
Hackers (Lazarus Group), Message displayed on Sony employee screens during the attack.

12Reaction and fallout

Public reaction

The public reaction was characterized by shock and outrage, particularly regarding the leaked salary information and the personal nature of the corporate communications. The incident highlighted the vulnerability of major corporations to state-sponsored digital warfare.

Political impact

The hack significantly heightened US-DPRK tensions, leading to increased diplomatic condemnation and strengthening the narrative of North Korea as a hostile cyber actor. It also spurred greater public and governmental awareness regarding the threat of state-sponsored cyber espionage.

Geopolitical consequences

The attack served as a major early example of cyber warfare used for political and punitive ends, contributing to the global discourse on cyber deterrence and the need for international norms regarding digital conflict.

13Legal

No specific criminal charges were filed against the DPRK government, but the incident contributed to increased US government efforts to sanction and track North Korean cyber activities.

Civil lawsuits

Sony Pictures Entertainment vs. Unknown · Operational and reputational damage claims · USA · Ongoing/Settled

14Aftermath

Policy changes

Increased focus on corporate cyber resilience and incident response planning.
Heightened governmental scrutiny of foreign state cyber threats.

Regulatory changes

None directly attributable, but contributed to the push for stronger data protection laws globally.

Security improvements

Mandatory implementation of advanced network segmentation and zero-trust architectures in large corporations.
Enhanced employee training regarding phishing and credential security.

15Significance and legacy

Significance

This incident is a landmark case study in cyber warfare, demonstrating the use of cyberattacks not just for espionage, but for massive, destructive operational sabotage. It marked a clear escalation in the use of digital tools for geopolitical retaliation, moving beyond simple data theft.

Legacy

The Sony hack fundamentally changed the corporate understanding of cyber risk, forcing companies to treat data breaches as existential threats. It also provided early, high-profile evidence used by security firms to attribute sophisticated, destructive attacks to specific nation-state actors.

16Disclosure and media

Authentication: Forensic analysis of leaked data and internal reports

Media partners

The New York Times
Reuters
BBC

Publishing organisations

WikiLeaks

18Field notes

01The hack was so severe that Sony employees were reportedly forced to use physical methods like fax machines and whiteboards to communicate and work for weeks.
02The leaked salary data revealed significant pay disparities, which became a major point of public controversy.

19Resolution

Sony eventually restored its core operations, but the incident resulted in massive financial losses, reputational damage, and a complete overhaul of its internal IT security infrastructure.