Sony Investigates Hackers Bypassing 2FA on PSN Accounts

Sony is investigating a critical security flaw affecting PlayStation Network (PSN) accounts, where threat actors are adding themselves to victim profiles without authorisation while bypassing password and two-factor authentication (2FA) controls. Reported on 27 October 2026, the vulnerability enables hackers to link themselves as child family members, granting them access to stored personal data and payment card details linked to the affected accounts. For Malaysian PlayStation console owners, the exploit poses a severe financial and privacy risk regardless of whether their profiles are protected by multi-factor authentication, making an immediate audit of console family settings essential.

Key Facts

How Are Hackers Bypassing PSN Two-Factor Authentication?

Hackers are bypassing standard authentication layers by exploiting the PlayStation Network family management architecture to enrol their own accounts as subordinate child accounts under unsuspecting users. This illicit association skirts conventional credential and 2FA barriers, enabling malicious actors to tap into account data, including credit card numbers and personal identity records tied to the primary profile.

Recent media tracking indicates the behaviour is not entirely unprecedented, as historical Reddit documentation dating back three years outlines instances of identical account-latching behaviour. While Sony confirmed to Japanese publication Sankei Shimbun that an active investigation is underway, the complete technical scope and remediation timetable of the exploit have not been publicly disclosed by the manufacturer.

Unauthorised actors are circumvating PlayStation Network passwords and two-factor authentication by registering themselves as linked child family members to harvest payment details.

What Should PlayStation Users Do to Protect Their Data?

PlayStation Network users should immediately sign in to their account settings to inspect the active members listed within their Family Management section. To mitigate payment abuse risks, users are advised to delink any saved credit or debit cards from their PSN wallets, preventing unauthorized individuals from exploiting retained card numbers during future checkout sessions.

Although multi-factor authentication remains standard cybersecurity hygiene across digital gaming services, this specific exploit circumvents verification prompts, rendering stored payment tokens vulnerable to linked child profiles. Manually entering payment credentials per transaction offers a direct safeguard against financial theft while Sony develops an official server-side patch.

Removing saved payment cards from PlayStation Network accounts prevents linked rogue profiles from abusing payment facilities while Sony probes the exploit.

What It Means for Malaysian Buyers

Malaysian PlayStation 4 and PlayStation 5 users face identical security exposures as global players because the PlayStation Network operates a uniform account and family management infrastructure worldwide. Sony has not issued a Malaysia-specific advisory or confirmed local case numbers through regional channels, meaning users cannot rely on automatic local protections or regional telco and distributor intervention.

Local players holding Malaysian PSN accounts linked to domestic credit or debit cards must manually log into account management to verify that no unknown subordinate accounts are listed under their Family Management tab. Until Sony concludes its investigation and releases a structural fix, decoupling local bank cards from the digital store interface remains the most dependable preventative action.

Malaysian PlayStation users must manually review their Family Management tabs and detach local payment cards, as Sony has not deployed a regional or automated fix.

Common Questions

Can two-factor authentication stop this specific PSN hack?

No, reports confirm that this particular vulnerability completely bypasses standard account passwords and two-factor authentication prompts, enabling hackers to latch onto victim profiles as child accounts without triggering verification checks.

What user data can hackers access through this exploit?

Once linked as child family members, attackers can view the personal details associated with the victim's account, including stored credit card details if payment instruments remain saved on the profile.

Has Sony issued a fix for the PSN vulnerability?

Sony has confirmed to Sankei Shimbun that it is actively investigating the issue, but the company has not yet detailed a comprehensive fix or confirmed when a permanent resolution will be implemented.

Sources and Methodology

Information in this dispatch is sourced directly from reporting by Lowyat.NET published on 27 October 2026, referencing statements and reports from Sankei Shimbun, GamesRadar+, Reddit, and X. No currency conversions were required as no commercial pricing was cited in the source material.