PSN flaw patched, but planted child accounts remain, researcher says
Attackers added 'child' accounts to victims' PlayStation Family groups without the password and without triggering 2FA; those accounts could view account data and make PlayStation Store purchases with a linked payment method. Sony is investigating and paid a $5,000 bounty to the Dutch researcher who reported the flaw, now patched, but he says the planted accounts are still in place. Review Family Management, contact support about unknown accounts, and keep 2FA ou passkeys enabled.
What happened
PlayStation Network users reported unknown accounts added to their family sharing without the password and without triggering two-factor authentication. Sony confirmed it is investigating. A Dutch researcher says the flaw has been patched and that Sony paid him $5,000, but adds that the attacker-planted accounts are still active.
Why it matters
Each planted account could view the victim's personal data and, depending on parental controls, make store purchases with a linked payment method. The researcher says attackers used those purchases to get support to hand over the main account despite 2FA or passkeys; one user reports losing a 12-year-old account with 250 digital games. Child accounts cannot simply be removed by the user, which makes recovery harder.
What to do
Review Family Management on PSN accounts now and contact Sony support if any account is unknown. Remove or review linked payment methods while checking. Keep 2FA or passkeys enabled, though the researcher says they were bypassed in this case.
For the technical team
- Affected
- Sony PlayStation Network (contas PSN) · PlayStation Network accounts using PlayStation Family / family sharing. No product version cited.
- Exploitation
- Exploitation reported by users on social media; Sony confirmed it is investigating. The Dutch researcher who reported the flaw told IntCyberDigest it is patched and that Sony paid him $5,000, but planted accounts remain. No CVE, KEV entry, or public PoC cited.
- Fix
- Fix already applied to PSN per the researcher and the incident timeline; no specific version or patch cited. Mitigation: review Family Management and contact Sony support to remove unknown child accounts, since users cannot simply remove them, per @Pirat_Nation.
- Vector
- PlayStation Network (PSN), PlayStation Family feature. The flaw let attackers plant 'child' accounts in a victim's family group without the password and without triggering 2FA. From the planted account, the attacker could access account information and, depending on parental-control settings, make PlayStation Store purchases with a linked payment method. The researcher says the purchases then got support to hand over the main account despite 2FA or passkeys.
- More details
- Reported chain: child account planted without password or 2FA, PlayStation Store purchases, then support hands the main account to the attacker, bypassing 2FA and passkeys. Discovery credited to a Dutch researcher, rewarded with $5,000 by Sony. Timeline: user reports and incident opened 2026-10-26; Sony confirms investigation the same day; 2026-10-27 the researcher discloses the patched flaw and the bounty; user @HazzadorGamin reports losing a 12-year-old account with 250 digital games and 94 platinum trophies.
Timeline
New user report: long-held PSN account with 250 digital games and 94 platinum trophies lost after being hacked.
Dutch researcher discloses patched PSN flaw and Sony's $5,000 bounty payment.
Sony says it is investigating; attackers are adding 'child' accounts to PlayStation Family groups without a password or 2FA prompt, which can expose account data and allow store purchases with a linked payment method.
Want the next updates in your inbox? Get the daily edition →
See all 4 updates
Incident opened.
Sources 4 sources
- @RinoTheBouncer @RinoTheBouncer
- @Pirat_Nation @Pirat_Nation
- @IntCyberDigest @IntCyberDigest
- @HazzadorGamin @HazzadorGamin
