Thực chất, chúng là cặp email trong cùng một kịch bản của hacker. Kịch bản tương tác diễn ra như sau:

Email đầu tiên không đính kèm file và chỉ có một nhiệm vụ duy nhất là khiến người nhận tin vào một câu chuyện thú vị: có người biết bạn qua Internet, muốn làm quen và sẽ gửi cho bạn vài bức ảnh. Đối với người sử dụng, email này có vẻ như vô hại và chắc chắn không ít người trả lời email kết bạn này.

Không lâu sau đó, người sử dụng sẽ nhận được một email khác, lần này có đính kèm “file ảnh” như đã đề cập trong email trước. Nhiều người sử dụng bị thuyết phục bởi kịch bản khá logic và tương tác này đã mở file đính kèm, và vậy là máy tính của họ bị nhiễm virus.

Virus này (Bkav nhận diện với tên W32.FakeHotpics.Worm) khi được thực thi sẽ download FakeAV từ địa chỉ : http://webcontrol-panel.us/l[removed]atch/softpatch.php?afid=154

Source: http://blog.bkav.com.vn/kich-ban-tuong-tac-giup-hacker-phat-tan-virus-qua-spam-email-thanh-cong%E2%80%9D-hon/

During the 1st quarter of 2011 we have tested 22 security products in the areas protection, repair and usability. The "Protection" covers static and dynamic malware detection, including real-world 0-Day attack testing. In case of "Repair", we check the system disinfection and rootkit removal in detail. The "Usability" testing includes the system slow-down caused by the tools and the number of false positives. A product has to reach at least 11 out of 18 possible points in order to receive a certification. 17 products have fulfilled our requirements and received an AV-Test certificate. The test reports can be found here:

SHOCKING NEW video of OSAMA BIN LADENS DEATH!!
Exclusive BANNED VDEIO footage of Osama Bin Laden being killed!!!

The CHFI course will give participants the necessary skills to identify an intruder's footprints and to properly gather the necessary evidence to prosecute. Many of today's top tools of the forensic trade will be taught during this course, including software, hardware and specialized techniques. The need for businesses to become more efficient and integrated with one another, as well as the home user, has given way to a new type of criminal, the "cyber-criminal." It is no longer a matter of "will your organization be comprised (hacked)?" but, rather, "when?" Today's battles between corporations, governments, and countries are no longer fought only in the typical arenas of boardrooms or battlefields using physical force. Now the battlefield starts in the technical realm, which ties into most every facet of modern day life. If you or your organization requires the knowledge or skills to identify, track, and prosecute the cyber-criminal, then this is the course for you.

XFA form definition

• template – object 201
• dataset – object 301

dataset - decoded data

template object definition

The JBIG2Decode filter (PDF 1.4) decodes monochrome (1 bit per pixel) image data that has been encoded using JBIG2 encoding. JBIG stands for the Joint Bi-Level Image Experts Group, a group within the International Organization for Standardization (ISO) that developed the format. JBIG2 is the second version of a standard originally released as JBIG1.

JBIG2 encoding, which provides for both lossy and lossless compression, is useful only for monochrome images, not for color images, grayscale images, or general data. The algorithms used by the encoder, and the details of the format, are not described here. A working draft of the JBIG2 specification can be found through the Web site for the JBIG and JPEG (Joint Photographic Experts Group) committees at < http://www.jpeg.org >.

Also note that JBIG2Decode and JPXDecode are not listed in Table 4.44 because those filters can be applied only to image XObjects.

Data representing JBIG2 stream (after initial FlateDecode filter)

Decoded content of the template object

• 18D1BA224B4FAA2296362F93231B6C4E7E488D8FEFC5A5408FE078AD20A55C08
• b1543cd42d03a93b143737d91540b08efffe027219136a59463f80e83222e743

TTF font hidden under JBIG2 stream

• 05f64217ebc380a9c398d72ec7743beda29bffed5694671aebca78aa6c3b5822

Source: https://blog.avast.com/2011/04/22/another-nasty-trick-in-malicious-pdf/

The IC3 is warning the public to be wary of romance scams in which scammers target individuals who search for companionship or romance online. Someone you know may be "dating" someone online who may appear to be decent and honest. However, be forewarned: the online contact could be a criminal sitting in a cyber café with a well-rehearsed script that scammers have used repeatedly and successfully. Scammers search chat rooms, dating sites, and social networking sites looking for victims. The principal group of victims is over 40 years old and divorced, widowed, elderly, or disabled, but all demographics are at risk.
Scammers use poetry, flowers, and other gifts to reel in victims, the entire time declaring their "undying love." These criminals also use stories of severe life circumstances, tragedies, deaths in the family, injuries to themselves, or other hardships to keep their victims concerned and involved in their schemes. Scammers also ask victims to send money to help overcome a financial situation they claim to be experiencing. These are all lies intended to take money from unsuspecting victims.
In another scheme, scammers ask victims to receive funds in the form of a cashier's check, money order, or wire transfer, claiming they are out of the country and unable to cash the instruments or receive the funds directly. The scammers ask victims to redirect the funds to them or to an associate to whom they purportedly owe money. In a similar scheme, scammers ask victims to reship packages instead of redirecting funds. In these examples, victims risk losing money and may incur other expenses, such as bank fees and penalties, and in some instances face prosecution.
Victims who have agreed to meet in person with an online love interest have been reported missing, or injured, or in one instance, deceased. IC3 complainants most often report the countries of Nigeria, Ghana, England, and Canada as the location of the scammers. If you are planning to meet someone in person that you have met online, the IC3 recommends using caution, especially if you plan to travel to a foreign country, and, at the very least:
      Do not travel alone.

      Read all travel advisories associated with the countries you will visit. Travel advisories are available at http://travel.state.gov/.

Baidu, China's most popular search engine, has just been found guilty--in China--for violating copyright on music lyrics found on its service. But this is China, home of dodgy thinking about intellectual property: The fine was just $8,000.

The case centers on 50 tracks owned by China's MCSC record label, the lyrics of which Baidu was making available through its MP3 lyrics search system. MCSC contended Baidu didn't have the rights to do this, and took the search engine to court. A judge in the Haidian district of Beijing has just examined the case, and ruled in favor of MCSC.

The penalty is to remove the offending content--a pretty standard move, of course--and pay compensation. The amount is laughable though: It's just 50,000 Yuan or $7,300, and another 10,000 Yuan in court fees. Arguably the matter concerns just 50 tracks, and the content in question is merely the lyrics. But that MCSC-owned IP will have been served up by Baidu to potentially millions of users, magnifying the issue somewhat. Though we're not talking about serious music pirating here, it does seem somewhat ridiculous that such a small penalty has been levied against a big-business search engine.

$8,000-odd dollars seems even more ridiculous when you look at the size of fines enforced in the U.S. for piracy--the most obvious counter example being the ruling against Jammie Thomas-Rasset, who faced a $2.4 million fine for pirating just 24 music tracks.
But, the Baidu ruling has a bigger, slightly iconic significance. Though there are some legal shenanigans behind the case, it demonstrates that serious questions of IP violation can be successfully tried in China. The nation is absolutely notorious for rampant theft of IP, be it gadget design, look and feel of Web sites, imagery, and code--in 2007, the Office of the U.S. Trade Representative added China to its "priority watch list" for widespread violation of copyright. Though nobody's suggesting that the Baidu case means that the legal establishment has turned a corner, and copyright will be viewed with a new respect, it may be seen as a test case, with seriously positive implications for other rights holders who've seen their creations stolen inside China. Chinese e-publishers recently planning to sue Baidu for copyright violations will also be watching this ruling closely.

Source: http://www.fastcompany.com

Valued PlayStation(R)Network/Qriocity Customer:
We have discovered that between April 17 and April 19, 2011,
certain PlayStation Network and Qriocity service user account
information was compromised in connection with an illegal and
unauthorized intrusion into our network. In response to this
intrusion, we have:
1) Temporarily turned off PlayStation Network and Qriocity services;
2) Engaged an outside, recognized security firm to conduct a full
and complete investigation into what happened; and
3) Quickly taken steps to enhance security and strengthen our
network infrastructure by rebuilding our system to provide you
with greater protection of your personal information.
We greatly appreciate your patience, understanding and goodwill
as we do whatever it takes to resolve these issues as quickly and
efficiently as practicable.
Although we are still investigating the details of this incident,
we believe that an unauthorized person has obtained the following
information that you provided: name, address (city, state, zip), country,
email address, birthdate, PlayStation Network/Qriocity password and login,
and handle/PSN online ID. It is also possible that your profile data,
including purchase history and billing address (city, state, zip),
and your PlayStation Network/Qriocity password security answers may
have been obtained. If you have authorized a sub-account for your
dependent, the same data with respect to your dependent may have
been obtained. While there is no evidence at this time that credit
card data was taken, we cannot rule out the possibility. If you have
provided your credit card data through PlayStation Network or Qriocity,
out of an abundance of caution we are advising you that your credit
card number (excluding security code) and expiration date may have
been obtained.
For your security, we encourage you to be especially aware of email,
telephone and postal mail scams that ask for personal or sensitive
information. Sony will not contact you in any way, including by email,
asking for your credit card number, social security number or other
personally identifiable information. If you are asked for this information,
you can be confident Sony is not the entity asking. When the PlayStation
Network and Qriocity services are fully restored, we strongly recommend that
you log on and change your password. Additionally, if you use your PlayStation
Network or Qriocity user name or password for other unrelated services or
accounts, we strongly recommend that you change them as well.
To protect against possible identity theft or other financial loss, we
encourage you to remain vigilant, to review your account statements and
to monitor your credit reports. We are providing the following information
for those who wish to consider it:
- U.S. residents are entitled under U.S. law to one free credit report annually
from each of the three major credit bureaus. To order your free credit report,
visit www.annualcreditreport.com or call toll-free (877) 322-8228.
- We have also provided names and contact information for the three major U.S.
credit bureaus below. At no charge, U.S. residents can have these credit bureaus
place a “fraud alert” on your file that alerts creditors to take additional steps
to verify your identity prior to granting credit in your name. This service can
make it more difficult for someone to get credit in your name. Note, however,
that because it tells creditors to follow certain procedures to protect you,
it also may delay your ability to obtain credit while the agency verifies your
identity. As soon as one credit bureau confirms your fraud alert, the others
are notified to place fraud alerts on your file. Should you wish to place a
fraud alert, or should you have any questions regarding your credit report,
please contact any one of the agencies listed below:
Experian: 888-397-3742; www.experian.com; P.O. Box 9532, Allen, TX 75013
Equifax: 800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
TransUnion: 800-680-7289; www.transunion.com; Fraud Victim Assistance Division,
P.O. Box 6790, Fullerton, CA 92834-6790
- You may wish to visit the website of the U.S. Federal Trade Commission at
www.consumer.gov/idtheft or reach the FTC at 1-877-382-4357 or 600 Pennsylvania
Avenue, NW, Washington, DC 20580 for further information about how to protect
yourself from identity theft. Your state Attorney General may also have advice
on preventing identity theft, and you should report instances of known or
suspected identity theft to law enforcement, your State Attorney General,
and the FTC. For North Carolina residents, the Attorney General can be
contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; telephone
(877) 566-7226; or www.ncdoj.gov. For Maryland residents, the Attorney
General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202;
telephone: (888) 743-0023; or www.oag.state.md.us.
We thank you for your patience as we complete our investigation of this
incident, and we regret any inconvenience. Our teams are working around the
clock on this, and services will be restored as soon as possible. Sony takes
information protection very seriously and will continue to work to ensure that
additional measures are taken to protect personally identifiable information.
Providing quality and secure entertainment services to our customers is
our utmost priority. Please contact us at 1-800-345-7669 should you have any
additional questions.
Sincerely,
Sony Computer Entertainment and Sony Network Entertainment
===================================
LEGAL
“PlayStation” and the “PS” Family logo are registered
trademarks and “PS3″ and “PlayStation Network” are
trademarks of Sony Computer Entertainment Inc.
(C) 2011 Sony Computer Entertainment America LLC.
Sony Computer Entertainment America LLC
919 E. Hillsdale Blvd., Foster City, CA 94404

The FBI has observed a trend in which cyber criminals —  using  the  compromised online banking credentials of U.S. businesses — sent unauthorized wire transfers to Chinese economic and trade companies located near the Russian border.   

Between March 2010  and April 2011, the FBI identified  twenty  incidents in which the online banking credentials of small-to-medium sized U.S.  businesses were compromised  and used to initiate wire transfers to Chinese  economic and  trade companies. As of  April 2011, the total attempted fraud amounts to approximately $20 million; the actual victim losses are $11 million.   

In a typical scenario, the computer of a person within a company who can initiate funds transfers on behalf of the  U.S.  business is compromised by either a phishing e-mail or by visiting a malicious Web site. The malware harvests the user’s corporate online banking credentials. When the authorized user attempts to log in to the user’s bank Web site, the user is typically redirected to another Web page stating the bank Web site is under maintenance or is unable to access the accounts. While the user is experiencing logon issues, malicious actors initiate the unauthorized transfers to commercial accounts held at intermediary banks  typically  located in New York. Account funds are then transferred to the Chinese economic and trade company bank account.  

Victims

Like most account takeover fraud,  the victims tend to be small-to-medium sized businesses and public institutions that have accounts at local community banks and credit unions, some of which use third-party service providers for online banking services.

Recipients

 The intended recipients of the international wire transfers are economic and trade companies located in the Heilongjiang province in the People’s Republic of China. The companies are  registered in port cities that are located near the Russia-China border

The FBI has  identified multiple companies that were used for more than one unauthorized wire transfer. However, in these cases the transfers were a few days apart and never used again. Generally, the malicious actors use different companies to receive the transfers. The companies used for this fraud  include the name of a Chinese port city in their official name. These cities include: Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning. The official name of the companies also include the words “economic and trade,” “trade,” and “LTD.”

 The economic and trade companies appear to be registered as legitimate businesses and typically hold bank accounts with the Agricultural Bank of China, the Industrial and Commercial Bank of China, and the Bank of China.

 At this time, it is unknown who is behind  these unauthorized transfers,  if the Chinese accounts were the final transfer destination or if the funds were transferred elsewhere,  or why the legitimate companies received the unauthorized funds.  Money  transfers to companies that contain these described characteristics should be closely scrutinized.

 Unauthorized Wire Transfers

 The unauthorized wire transfers range from $50,000 to $985,000. In most cases, they tend to be above $900,000, but the malicious actors have been more successful in receiving the funds when the  unauthorized  wire transfers  were  under $500,000.  When the transfers went through successfully, the money was immediately withdrawn from or transferred out of  the recipients’ accounts. 

 In  addition to the large wire transfers, the malicious actors also sent domestic ACH and wire transfers to money mules in the United States  within minutes of conducting the overseas transfers. The domestic wire transfers range from $200 to $200,000. The intended recipients are money mules, individuals who the victim company has done business with in the past, and in one instance, a utility company located in another U.S. state. The additional ACH transfers initiated using compromised accounts range from $222,500 to $1,275,000.   

 Malware

The type of malware has not been determined in every case but some of the cases involve ZeuS, Backdoor.bot, and  Spybot. In addition, one victim reported  that  the hard drive of the compromised computer that was infected was erased remotely before the IT department could investigate.

   ZeuS  —  malware that has the capability to steal multifactor authentication tokens, allowing the criminal(s)  to log in to victims’ bank accounts with the user name, password, and token ID.  This can occur during a legitimate user log-in session.

   Backdoor.bot — malware that has worm, downloader, keylogger, and spy ability. The malware allows for the criminal(s)  to access the infected computer remotely and  further infect computers by downloading additional threats from a remote server. 3

   Spybot —  an IRC backdoor Trojan which runs in the background as a service process and allows unauthorized remote access to the victim computer.

   Recommendation to Financial Institutions

   Banks should notify their business customers of any suspicious wire activity going to the following Chinese cities: Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning.  

  Wire activity destined for the Chinese cities of Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning should be heavily scrutinized, especially for clients that have no prior transaction history with companies in the Heilongjiang province.  

For recommendations on how businesses can Protect, Detect, and Respond to Corporate Account

Take overs such as this, please refer to the “Fraud Advisory for Businesses: Corporate Account

Take Over” available at http://www.fsisac.com/files/public/db/p265.pdf.

 Incident Reporting

http://www.forensix.org/tools/

http://www.forensix.org/tools/

• The amount of spam in email traffic increased by 0.9 percentage points compared to February and averaged 79.6%.
• Phishing emails accounted for 0.02% of all mail traffic, a decrease of 0.01 percentage points compared to the previous month.
• Malicious files were found in 3.23% of all emails, an increase of 0.05 percentage points compared to February’s figure

 Source: http://www.securelist.com/en/analysis/204792171/Spam_report_March_2011
Read more:

Spam report: January 2011

Spam report: February 2011

• The amount of spam in email traffic increased by 0.9 percentage points compared to February and averaged 79.6%.
• Phishing emails accounted for 0.02% of all mail traffic, a decrease of 0.01 percentage points compared to the previous month.
• Malicious files were found in 3.23% of all emails, an increase of 0.05 percentage points compared to February’s figure

 Source: http://www.securelist.com/en/analysis/204792171/Spam_report_March_2011
Read more:

Spam report: January 2011

Spam report: February 2011

Một phụ nữ tại Los Angeles, Mỹ đã bị quấy rối và tấn công bởi người đàn ông cô quen qua trang web hẹn hò trực tuyến Match.com khi cả hai cùng hẹn nhau gặp gỡ.

Vụ tấn công, theo lời kể nạn nhân, xảy ra khi hai người gặp nhau trong buổi hẹn thứ hai, khi gã này bám theo cô gái về tận nhà và tấn công cô. Sau khi vụ việc xảy ra, cô đã tìm hiểu và phát hiện kẻ tấn công mình từng có tiền sử tội ác và vì thế cô quyết định đâm đơn kiện trang Match.com ra tòa án Los Angeles.

Nạn nhân không đòi bồi thường tiền bạc, thay vào đó cô yêu cầu những người đứng đầu trang Match.com phải hiển thị một danh sách những thành viên có tiền sử phạm tội (tấn công và quấy rối tình dục) lên trang chủ của dịch vụ.

Công tố viên Mark L.Webb, đại diện cho bên bị hại, cho biết ông sẽ yêu cầu thẩm phán tòa án tối cao Los Angeles ban hành một lệnh cấm (tạm thời) trang Match.com được nhận thêm thành viên đăng ký mới, cho đến khi nào yêu cầu của thân chủ ông được đáp ứng. “Họ (Match.com) là dịch vụ hẹn hò trực tuyến rất thành công và cũng rất lớn, họ hoàn toàn có đủ điều kiện để đáp ứng yêu cầu này” - Webb cho biết.

Về phía bị đơn, trong một bài nói chuyện với kênh truyền hình KABC-TV 7 Channel, đại diện của Match.com nói luôn cung cấp những khuyến cáo an toàn cho người sử dụng dịch vụ khi họ đăng ký làm thành viên và những sự cố (nếu có) xảy ra ngoài đời thực nằm ngoài phạm vi trách nhiệm của trang web.

Nạn nhân, còn được biết đến với tên Jane Doe, đã tốt nghiệp Đại học Ivy League, hiện đang làm trong ngành phim ảnh và truyền hình. Cô gặp kẻ tấn công mình vào năm ngoái tại Tây Hollywood. Buổi hẹn đầu diễn ra rất ổn, tuy nhiên vào lần gặp gỡ thứ hai điều không may đã xảy ra.

“Sự cố kinh khủng này đã làm tôi tổn thương nặng nề, vì tôi vốn luôn cho rằng mình hiểu biết hết về sự an toàn cũng như rủi ro trong việc hẹn hò trực tuyến” - cô tâm sự.

Vì nhiều lý do cũng như hoàn cảnh đặc biệt, hẹn hò trực tuyến tỏ ra tương đối có ích cho rất nhiều người, dịch vụ này sẽ giúp họ tìm được người cùng sở thích để từ đó hẹn hò cùng nhau, và nếu đủ may mắn sẽ dẫn dắt hai người đến những mối quan hệ sâu sắc hơn, đó là ý nghĩa căn bản rất nhân văn của loại hình dịch vụ trực tuyến này.

Tuy nhiên, có câu nói “mọi đồng xu đều có hai mặt của nó”, hẹn hò online đôi khi có thể trở nên rất nguy hiểm, bạn không thể biết được người mình sắp hẹn gặp thật sự là ai. Thế nên bạn cần trang đủ kiến thức và thông tin trước khi gặp gỡ một ai đó từ Internet.

Vietnamnet 

A Los Angeles woman who this week filed suit against Match.com, saying she was sexually assaulted by a man she met on the dating site, is speaking out about the incident.

Attorney Mark L. Webb, who represents the woman identified in the lawsuit only as Jane Doe, said he will ask a Los Angeles County Superior Court judge for a temporary injunction barring the site from signing up more members until his client's demands are met. He said his client wants the site to screen members to determine if they are sexual predators.

"They are a very powerful and successful online dating service, and they have the means to do this," Webb said.

In an interview with KABC-TV Channel 7, the woman said her relationship with the man started innocently enough: "He sent me an email and said he was into golf and tennis and he had a house in the Palisades over Malibu and he liked art and culture, travel and food."

Webb described his client as an Ivy League graduate who works in film and television. He said she met her alleged assailant last year at Urth Cafe in West Hollywood. He seemed charming and she agreed to see him again, he said.

But after the second date, the woman said, the alleged assault occurred: "He went straight into the bathroom when he came in my place and I sat down on the couch and waited for him," she told the TV station. "Then he came out of the bathroom and jumped me and forced me to have oral sex and then he left."

"This horrific ordeal completely blindsided me because I had considered myself savvy about online dating safety," the woman said in a statement released through her attorney last week. "Things quickly turned into a nightmare, beyond my control."

After the man left, the woman went online and learned that he had been convicted of several counts of sexual battery. Charges are pending in the Match.com case, Webb said.

The attorney said his client wants Match.com to check members' names against public sex offender registries. "It's not a guarantee," he said. "But don't you think something is better than nothing?"

Officials with Match.com could not be reached for comment late Wednesday. But in a statement to KABC-TV last week, officials that they provide safety tips on the website and warn members that they are responsible for screening the people they meet.

"While incidents like this one between individuals who meet on Match.com are extremely rare, it doesn't make them any less horrifying," the statement said. 

Source: Woman suing Match.com over alleged sexual assault speaks out about incident

=================================== 
 
PlayStation(R)Network
 
=================================== 

Valued PlayStation(R)Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011, 
certain PlayStation Network and Qriocity service user account 
information was compromised in connection with an illegal and 
unauthorized intrusion into our network. In response to this 
intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full 
and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our 
network infrastructure by rebuilding our system to provide you 
with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill 
as we do whatever it takes to resolve these issues as quickly and 
efficiently as practicable.

Although we are still investigating the details of this incident, 
we believe that an unauthorized person has obtained the following 
information that you provided: name, address (city, state, zip), country, 
email address, birthdate, PlayStation Network/Qriocity password and login, 
and handle/PSN online ID. It is also possible that your profile data, 
including purchase history and billing address (city, state, zip), 
and your PlayStation Network/Qriocity password security answers may 
have been obtained. If you have authorized a sub-account for your 
dependent, the same data with respect to your dependent may have 
been obtained. While there is no evidence at this time that credit 
card data was taken, we cannot rule out the possibility. If you have 
provided your credit card data through PlayStation Network or Qriocity, 
out of an abundance of caution we are advising you that your credit 
card number (excluding security code) and expiration date may have 
been obtained.

For your security, we encourage you to be especially aware of email, 
telephone and postal mail scams that ask for personal or sensitive 
information. Sony will not contact you in any way, including by email, 
asking for your credit card number, social security number or other 
personally identifiable information. If you are asked for this information, 
you can be confident Sony is not the entity asking. When the PlayStation 
Network and Qriocity services are fully restored, we strongly recommend that 
you log on and change your password. Additionally, if you use your PlayStation 
Network or Qriocity user name or password for other unrelated services or 
accounts, we strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss, we 
encourage you to remain vigilant, to review your account statements and 
to monitor your credit reports. We are providing the following information 
for those who wish to consider it:    
- U.S. residents are entitled under U.S. law to one free credit report annually 
from each of the three major credit bureaus. To order your free credit report, 
visit www.annualcreditreport.com or call toll-free (877) 322-8228. 

- We have also provided names and contact information for the three major U.S. 
credit bureaus below.  At no charge, U.S. residents can have these credit bureaus 
place a "fraud alert" on your file that alerts creditors to take additional steps 
to verify your identity prior to granting credit in your name. This service can 
make it more difficult for someone to get credit in your name. Note, however, 
that because it tells creditors to follow certain procedures to protect you, 
it also may delay your ability to obtain credit while the agency verifies your 
identity.  As soon as one credit bureau confirms your fraud alert, the others 
are notified to place fraud alerts on your file. Should you wish to place a 
fraud alert, or should you have any questions regarding your credit report, 
please contact any one of the agencies listed below: 

Experian: 888-397-3742; www.experian.com; P.O. Box 9532, Allen, TX 75013
Equifax: 800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
TransUnion: 800-680-7289; www.transunion.com; Fraud Victim Assistance Division, 
P.O. Box 6790, Fullerton, CA 92834-6790 

- You may wish to visit the website of the U.S. Federal Trade Commission at 
www.consumer.gov/idtheft or reach the FTC at 1-877-382-4357 or 600 Pennsylvania 
Avenue, NW, Washington, DC 20580 for further information about how to protect 
yourself from identity theft. Your state Attorney General may also have advice 
on preventing identity theft, and you should report instances of known or 
suspected identity theft to law enforcement, your State Attorney General, 
and the FTC. For North Carolina residents, the Attorney General can be 
contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; telephone 
(877) 566-7226; or www.ncdoj.gov. For Maryland residents, the Attorney 
General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202; 
telephone: (888) 743-0023; or www.oag.state.md.us.

We thank you for your patience as we complete our investigation of this 
incident, and we regret any inconvenience. Our teams are working around the 
clock on this, and services will be restored as soon as possible. Sony takes 
information protection very seriously and will continue to work to ensure that 
additional measures are taken to protect personally identifiable information. 
Providing quality and secure entertainment services to our customers is 
our utmost priority. Please contact us at 1-800-345-7669 should you have any 
additional questions.

Sincerely,

Sony Computer Entertainment and Sony Network Entertainment

Download:

Vietnam
English