Analysis: Sony bungles data breach response

By on
Analysis: Sony bungles data breach response

Actions of Sony, Toyota indicate lack of transparancy in corporate Japan.

Sony's handling of a massive network security breach is becoming a public relations nightmare reminiscent of Toyota's bungled recalls response last year, fuelling criticism of corporate Japan's standards of disclosure.

This week, Sony announced that hackers had breached its online PlayStation Network a week earlier, compromising the names, addresses and possibly credit card data of 77 million users.

The delay, which Sony said was needed to conduct a forensic investigation, may remind its overseas customers of the foot-dragging by Toyota that earned the Japan's leading automaker the disdain of consumers.

"Given the layers of corporate management and the lengthy consultations that tend to be par for Japanese corporations, a week is not that slow," said Jeff Kingston, a professor at Temple University in Japan, who has written about transparency.

"But for the people whose information has been breached, its definitely a week too slow."

Blessed with first-rate technology that helps them compete around the world, Japanese corporations are sometimes hobbled by second-rate public relations.

At home, where customers complain little and rarely sue, public relations gaffes are not a major problem, but in foreign markets that now account for most of their sales and growth, such a failing can be a costly handicap.

Customers of Sony's PlayStation network, nine out of 10 who are based in the United States or Europe, were quick to express their anger.

"The fact that you've waited this long to divulge this information to your customers is deplorable. Shame on you," read one message on the PlayStation Network blog from a user under the name Korbei83.

Too little, too late

For the first two weeks of Toyota's recall crisis in 2010, the carmaker's CEO Akio Toyoda stayed silent, angering customers in the United States, where unintended acceleration incidents were blamed for hundreds of accidents.

When he finally did appear, Toyoda apologized and cried, and the car maker was eventually exonerated by an inquiry that found drivers were mostly at fault.

But by then the damage was done.

In its annual Best of Global Brand survey last year, UK-based branding agency Interbrand estimated the value of the Toyota brand to have fallen 16 percent or US$5.1 billion ($4.7 bilIion).

Also in 2010, the U.S. auto market grew 11 percent while Toyota's sales dipped 0.4 percent.

"In the US, the CEO's responsibility is to be the huckster-in-chief. That's definitely not a Japanese style," Temple University's Kingston said.

The world caught a recent glimpse of Japan's information-scarce corporate culture and shy CEOs following the nation's earthquake and tsunami on March 11.

As people in Japan and neighboring countries clamored for information on radiation spewing from a nuclear plant 240 kilometers north of Tokyo, Mastaka Shimizu, the CEO of plant owner Tokyo Electric Power hid away from the public gaze for a month.

"The first thing [companies] have to do is say, 'This is an issue, this is what we know about it'," said Deborah Hayden, managing partner in Tokyo at communications consultancy Kreab & Gavin Anderson.

"Sometimes at Japanese companies, the ability to give authority to a spokesperson is perhaps a little slow and the spokesperson hasn't got the full authority to speak on behalf of the company on a serious issue," she added.

Sony CEO Howard Stringer has not commented on the security breach.

The pressure on companies to be more timely and open in Japan is less because not doing so is less likely to result in legal action, noted Makoto Ikeya of NERA consulting in Tokyo, who's an expert on litigation arising from inaccurate or untimely disclosure.

"Compared with the United States, the number of litigations bought for misstatements or untimely disclosure is still very small," Ikeya said. That means "it may take some time for them to get accustomed to the type of legal actions taken in say the United States," he added.

With criticism mounting, Sony on Wednesday changed its statement explaining the reason why it waited a week to reveal the breach by hackers.

After saying it turned off the PlayStation network when it found user information had been compromised, the company now says its investigation didn't reveal the "scope of the breach" until Tuesday.

It also issued a thorough, 17-point Q&A on the breach on its website on Wednesday after the media storm erupted.

But with US Democratic senator Richard Blumenthal demanding an explanation for Sony's week of silence, the Japanese company is under pressure to give a more detailed account.

The only silver lining for Sony, said Temple University's Kingston, is that Toyota's poor response last year means expectations of a quick and full response are not high.

"Toyota did everybody a favor, they set the bar low," he said.

(Additional by Rachel Armstrong in SINGAPORE; Editing by Lincoln Feast)

Got a news tip for our journalists? Share it with us anonymously here.

Most Read Articles

Log In

  |  Forgot your password?