Hollywood’s fears grow about the risks of streaming

Adobe Stock/Getty Images

Ten years ago, a hacker group calling itself The Guardians of Peace released a huge amount of Sony Pictures’ internal communications and data. What was its demand? A demand for Sony to withdraw an upcoming film, Interviewwhich starred Seth Rogen and James Franco as journalists trying to get an interview with Kim Jong-un.

What followed became an international story and eventually led to some Sony executives stepping down due to the embarrassing content of their communications.

Earlier this month, the hacktivist group Nullbullz, which says it chooses its targets based on “protecting artists’ rights and ensuring fair compensation for their work,” dumped a terabyte of data from the Walt Disney Company, including communications from internal Slack channels, images, logins and other data.

“Enjoy it,” the group told visitors to its website.

Of course, the Disney hack of 2024 is not the Sony hack of 2014. While the Sony hackers appear to have a very specific goal (shutting down a controversial film), the Disney hackers appear to have more concocted motivations (for example, a hatred of artificial intelligence-generated art).

But in many ways, this new hack is emblematic of a worrying, growing trend that has affected many companies in the media and entertainment sector.

In just the past few months, Roku suffered a breach affecting hundreds of thousands of user accounts, and Ticketmaster owner Live Nation revealed that a hacker group obtained data on more than 500 million of its customers. In early July, AT&T disclosed a massive breach involving call and text data belonging to “nearly all” of its wireless customers.

The reason behind all these hacking was very clear: cash.

“Most of this is about dollars and cents, it’s not inherently about making a statement,” says Collin Walke, an attorney at Hall Estill, a firm that specializes in cybersecurity issues. “Sure, on some occasions it might be, and on some occasions maybe it’s national security, but in the vast majority of these cases, it’s dollars.”

In Roku’s case, hackers sold account data for 50 cents per account, while Ticketmaster hackers demanded a ransom from the company to erase its customer data. AT&T paid its hackers $370,000 in bitcoin to erase the stolen data, According to WiredWho spoke to the mediator who brokered the deal.

“In general, I would say the hacker is trying to steal some type of data,” according to security consultant Tyler Hudak. “Most of the time, the attacker will try to steal that data and make money off of it, either through some type of ransom or by auctioning it off to the highest bidder on the dark net.”

But many experts say large media, entertainment and telecommunications companies could be particularly attractive targets for hackers.

For starters, companies that are household names tend to be higher-profile targets. And as entertainment companies move further into direct-to-consumer streaming, they’re “more likely to have data that someone would be concerned about,” Hudak says.

This may include personal information about streaming customers, credit card numbers or other information.

“If somebody is a big organization like Disney or AT&T or Ticketmaster, they’re definitely going to be a bigger target,” says Hudak. “First of all, the attackers will know they have a lot more money than some small manufacturing firm in the Midwest. The attacker will get more credibility by saying, ‘Oh, I hacked Disney,’ rather than some mom-and-pop shop.”

And the value of that data is only increasing, thanks to other new technologies that make it easier for attackers to use it for nefarious purposes.

“Everyone needs to understand that the storage of this data presents a huge risk to everyone, because with AI, hackers are now able to drill into that data very quickly and make connections between individuals or embarrassing moments very quickly,” says Valcke.

And the extraordinary proliferation of corporate hacking is helped by the fact that the cost and skill required to perform large-scale hacking has dropped significantly since Sony a decade ago. Work that was previously the purview of mostly nation-state actors or large conglomerates can now be accomplished with turnkey, off-the-shelf software available for purchase on the dark web.

For many large companies, this data may also be somewhat out of their control. The Ticketmaster and AT&T breaches were linked to a third-party cloud provider called Snowflake, while the Disney breach appears to be focused on its accounts from Salesforce-owned messaging platform Slack. Google-owned security firm Mandiant says it identified and notified 165 Snowflake clients that were affected.

While companies have some ability to limit access, if a third party has a vulnerability, their customers could be at risk.

“A lot of companies like AT&T are using third-party cloud service providers,” says Walke. “These third parties say, ‘We’ll keep your data safe.’ Well, I’m glad you got a piece of paper, but what are you doing to verify it?”

The risks of relying on third parties became even more ironically evident on July 19, when companies relying on software from cybersecurity firm CrowdStrike saw their systems crash after a botched “content update.” Airlines, banks, public agencies, and even broadcasters such as NBC and Sky News were affected.

The number of reported hacking incidents will likely increase over time, not only because it’s becoming simpler and more lucrative, but also because new rules from the Securities and Exchange Commission require public companies to disclose “significant” cybersecurity incidents.

“As a result, there are a lot of companies that didn’t report before, and now they’re reporting because this is the kind of thing that can rise to the level of a material incident,” says Chris Pearson, CEO of consultancy BlackCloak.

But the biggest point is that, although the Sony hack was shocking and newsworthy a decade ago, in 2024, in a world where all companies have a wealth of data, cyber insurance, and security consultants, the threat of hacking may be the new normal.

“I think all of these big breaches have shown us that it doesn’t matter how big an organization is, how much money they might put into their security budget,” Hudak says. “Ultimately everyone is at risk. Planning for that goes a long way.”