Skip to content
←Back to glossaryCyber

Sony Pictures hack (2014)

Destructive attack on Sony Pictures Entertainment launched on November 24, 2014, attributed by the FBI to North Korea on December 19. For the first time, Washington openly blamed a foreign government for such an attack on a US company.

Definition

On November 24, 2014, screens at Sony Pictures Entertainment showed a red skeleton and the signature of the Guardians of Peace. A wiper destroyed thousands of workstations and servers, unreleased films leaked, then executive emails and employee data. The apparent motive was The Interview, a comedy about the assassination of Kim Jong Un. On December 19, the FBI attributed the attack to the North Korean government; President Obama promised a "proportional" response, and Executive Order 13687 of January 2, 2015 sanctioned North Korean entities. In September 2018, the Justice Department charged Park Jin Hyok, described as a member of the Lazarus group. For the market, Sony was the first case of a destructive attack on a private company attributed to a state by the victim's own government, within weeks. Policies at the time had no cyber war exclusion, and the classic war exclusion was not where the argument took place. The lesson came later: a fast, official attribution, which helps the victim explain its incident, can also bring the loss within the state-backed attack exclusion.

Its 6 cross-references, woven across the glossary's 18 categories
Sony Pictures hack (2014): Cyber glossary illustration, AlgoPolis
Example

Hypothetical: a production studio insured in 2025 with LMA 5567 is hit by a wiper after announcing a satirical film about a foreign leader. Three weeks later, its own government attributes the attack to that state's intelligence service. The insurer, which had started paying restoration costs, gives notice that it reserves its rights on the rest under the exclusion.

Read next
CyberLazarus Group (North Korea)A set of operators tied to North Korean intelligence who conduct bank theft, crypto-asset theft and destruction. The United States has sanctioned them, so any payment to them breaches sanctions.Read the entry →CyberWiper malwareMalware designed to destroy or render data irrecoverable, with no intent of ransom, often for sabotage or geopolitical ends.Read the entry →CyberAttribution of a cyber operation to a stateWho decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

Sony Pictures hack, Sony Pictures 2014, Guardians of Peace, Sony Pictures Entertainment breach

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.