Sony Pictures Entertainment has agreed to pay up to $8 million to reimburse current and former employees for the costs associated with identity theft losses and other issues stemming from a massive hack in 2014.
The settlement agreement, filed in federal court in Los Angeles, must still be approved by a judge. Under its terms, Sony will also cover the costs associated with settlement administration and providing identity protection for "participating class members" for two years.
Sony’s computer system was compromised repeatedly by hackers calling themselves Guardians of Peace in fall 2014 in an attempt to derail the North Korea spoof comedy The Interview.
The group of current and former employees had sued over the loss of sensitive personal data during the hack, including 47,000 Social Security numbers, employment files, salaries, and medical information — a leak that caused an “epic nightmare,” the complaint states.
The employee group contends in the lawsuit that the core of what went wrong at Sony boiled down to two inexcusable problems: That the studio failed to secure it’s computer systems, servers, and databases despite knowing of weaknesses for years, and that Sony failed to protect confidential information from falling into the hands of hackers.
According to their attorney, Cari Laufenberg, Sony employees who spent time, or have unreimbursed costs related to measures they took to avoid identity theft, may submit claims for up to $1,000 each from a $2-million fund.
Under the proposed settlement, Sony will also pay for identity protection services for an additional two years, Laufenberg said. Any future identity theft incident not already protected will be covered through 2017.
“We are pleased with this resolution, which we believe addresses the real world needs of those impacted by the SPE data breach,” she told BuzzFeed News.
Class-action attorneys can apply for up to $3.49 million in fees, costs, and expenses to be awarded with the court's approval.
Sony did not immediately respond to BuzzFeed News' request for comment, although the Associated Press reported that, in a memo to staff, Sony Entertainment CEO Michael Lynton called the agreement "an important, positive step forward in putting the cyber-attack firmly behind us."
In addition to personal information, the hack exposed email conversations of Sony executives and other industry figures that shed them in a less than favorable light. In one exchange, film producer Scott Rudin called Angelina Jolie a “spoiled brat.” And in another, then-Sony Pictures co-chair Amy Pascal and Rudin joked about President Obama liking movies about black historical subjects.
Pascal would later step down from her powerful position to lead a production company based on Sony’s campus in Culver City, California. Pascal later told Tina Brown in an interview that she had been fired.
The most obvious hit to Sony besides the direct cost of detecting and responding to the hack was The Interview, the action comedy starring James Franco and Seth Rogen as two journalists sent on a mission to assassinate North Korea's Kim Jong-un. The film was pulled from its planned cinematic release following a threat issued by a group purporting to be the hackers, which warned of attacks on theaters screening the film.
U.S. law enforcement and intelligence agencies have blamed North Korea for the hack. While The Interview was released online, and set a digital record by garnering some $40 million in streaming revenue, it likely was not a moneymaker for the studio.