Sony and Valve: A tale of two hacking responses

Like a lot of people in the gaming world, I got an interesting email from Gabe Newell last week. The Steam hacking incident of last November, he said, was worse than they initially thought it was. And while there still was no direct evidence that credit card information had been accessed, a backup file containing that information (albeit encrypted) was obtained by the person or persons who had broken into the system. It was disquieting information delivered in an oddly comforting manner – and while the service has 40 million user accounts under its control, there wasn't a lot of outrage in the forums and throughout the online world. It was a curious juxtaposition to what Sony had faced just a year prior. During that hack, of course, the level of hostility aimed at Sony was staggering. Players and the media hit the company for its lack of transparency and seemingly unapologetic attitude toward the attack. Large scale game hacking was, after all, a brave new world – and one that no one was really prepared for (something that seems absurd in retrospect). Was Valve's reaction to its hacking problem truly better than Sony's? Or were there other factors at play? The answer, I think, is both. It's hard to find anyone who will defend Sony's handling of the hacking incident – including inside the office of that company. But Sony's missteps and stumbles helped other developers and publisher learn what to avoid. And no one learned better than Valve. When the Steam database was breached, Valve's Gabe Newell sent an IM to users alerting them to the incident, explaining the situation (and what the company was doing) and quickly apologized. That note came four days after hackers hit the company's forums – the first sign of trouble. Sony, meanwhile, waited six days before giving any real visibility into the severity of the situation – though it did acknowledge the outage and let people know it was looking into things almost immediately. That's not a significantly longer time period, but the company was quickly put on the defensive. The first formal apology from a Sony official didn't come for another five days, when Kaz Hirai held a press conference in Japan. Like Valve, all of the bad news didn't hit at once. It consecutively got worse. Just as users were absorbing the PSN and Qriocity music service hits, it was discovered that Sony Online Entertainment was also hit. And then the copycat attacks started coming, this time at Sony Pictures. It was a perfect storm of bad news brought on by hackers looking to latch on to the media blitz. Valve, hopefully, has reached the end of its road as far as bad news goes. But the fact that it took three months to discover the extent of the breach and notify users was interesting, especially for the lack of reaction. Valve, of course, encountered its hacking problems with a few advantages. Sony, as a multinational, multi-billion dollar company, had to overcome a reputation of a big, faceless empire. Valve has always maintained a relationship with the community – and ensured its place as a gamer favorite when it reached out to them for help when the Half-Life 2 source code was stolen. Newell has also maintained a direct relationship with is customers – emailing back and forth with them regularly. This goodwill undoubtedly helped the company when dealing with the fallout of this incident – as did studying the moves of those hit by hackers before it. While Steam's messaging was certainly better worded than Sony's, its timeliness was roughly the same. But ultimately, I think gamers have gotten over the hysteria of hacker attacks. Rather than obsessing over identity theft or stolen credit card numbers, they now know to put an alert on their credit reports and that they won't be liable for any charges made if, in fact, those card numbers are stolen. What was so unthinkable a year ago is now commonplace – an annoyance that's worth keeping an eye on, but not worth panicking over. But how a company handles that is just as important. And you can bet your bottom dollar that EA, Microsoft and any other company that handles credit card data from customers, is taking note on how Valve has successfully negotiated these waters.