CASE-23 · Case Study — Sony Pictures 2014: The Destructive Breach

What happened

In November 2014, employees at Sony Pictures turned on their computers to find a red skull and a warning from a group calling itself the Guardians of Peace. This was not ransomware asking for money — it was a destructive attack. The intruders had spent time inside the network, quietly stealing terabytes of data, and then unleashed wiper malware that erased data and rendered a large share of Sony's computers and servers unbootable.

Then came the leaks. The attackers dumped unreleased films, embarrassing internal emails, salary lists, and the personal data of tens of thousands of current and former employees. The FBI publicly attributed the attack to North Korea, tying it to Sony's planned release of a comedy film about that country's leadership. Sony was knocked back to pen, paper, and personal phones for weeks.

See it — steal everything, then destroy it

flowchart LR
  A["Initial intrusion<br/>+ persistence"] --> B["Recon +<br/>credential theft"]
  B --> C["Exfiltrate terabytes<br/>of data"]
  C --> D["Deploy wiper:<br/>erase machines"]
  D --> E["Leak stolen data<br/>publicly"]

The root cause

Several weaknesses compounded. The attackers moved freely once inside — a sign of flat network trust and weak internal segmentation. Sensitive material, including passwords and certificates, was reportedly stored in plaintext and easily accessible. And detection was slow: a large-scale exfiltration and staging of destructive malware went unnoticed until the attackers chose to reveal themselves. The breach wasn't one flaw; it was the absence of layered defense and monitoring.

The control that would have stopped (or limited) it

Segmentation, least privilege, and detection would have contained the intrusion: separating critical systems, limiting credential reach, and alerting on mass data movement would have shrunk both the theft and the wiper's reach. Encrypting secrets and sensitive files at rest (never plaintext passwords) would have blunted the leaks. And tested, offline backups would have sped recovery from the destruction.

The blast radius

Roughly half of Sony's computers and servers were wiped; recovery and remediation ran into the tens of millions of dollars, and the leaked emails and data caused lasting reputational and legal fallout. Strategically, it was a landmark: a nation-state using destructive cyber-attack to coerce a company, which reshaped how governments and businesses think about cyber as a tool of geopolitical pressure.

How it unfolded

timeline
  title From silence to skull
  Months prior : Intrusion, recon, quiet exfiltration
  Nov 24 2014 : Wiper detonates; ransom/warning screen appears
  Nov-Dec 2014 : Stolen data leaked in waves
  Dec 2014 : FBI attributes the attack; US-CERT alert issued

The lesson

Assume an attacker may want to destroy, not just steal — and design for it: segment networks so intruders can't roam, encrypt secrets so a breach doesn't hand over the keys, monitor for mass data movement, and keep offline backups so a wiper can't end you. Detection and containment matter as much as prevention, because a determined adversary will eventually get in; the question is how far they can get once they do.

Where it rhymes

It rhymes with NotPetya's destructive spread and with every breach where flat networks and plaintext secrets turned a foothold into a catastrophe — and with the defense-in-depth and least-privilege principles that assume the perimeter will fall.