N Korea-linked Sony hack may be costliest ever

NEW YORK (AP) — A U.S. official says North Korea has been linked to the unprecedented act of cyberwarfare against Sony Pictures that exposed tens of thousands of sensitive documents and escalated to threats of terrorist attacks that ultimately drove the studio to cancel all release plans for the film at the heart of the hack, "The Interview."

The attack is possibly the costliest for a U.S. company ever, said Avivah Litan, a cybersecurity analyst at research firm Gartner. "This attack went to the heart and core of Sony's business — and succeeded," she said. "We haven't seen any attack like this in the annals of U.S. breach history."

Federal investigators believe there is a connection between the Sony Pictures hack and the isolated communist nation, according to an official who spoke on condition of anonymity because the official was not authorized to openly discuss an ongoing criminal case. Earlier in the day, the besieged company cancelled the Christmas Day release of "The Interview," citing the threats of violence against movie theaters and decisions by the largest multiplex chains in North America to pull the film from its screens. Seemingly putting to rest any hope of a delayed theatrical release or a video-on-demand release, Sony Pictures later said it has "no further release plans for the film."

The cancellation was a startling blow to the Hollywood studio. The hackers, who call themselves Guardians of Peace, on Tuesday had threatened violence reminiscent of September 11th, 2001 against movie theaters showing the film. Sony cancelled a planned New York premiere and offered theaters the option of bowing out. One after the other, all the top U.S. movie chains announced they would postpone any showings of the comedy, which features a pair of journalists played by James Franco and Seth Rogen that are tasked by the CIA to assassinate North Korea leader Kim Jong Un. Sony said it then had little choice but to cancel the release.

"We are deeply saddened at this brazen effort to suppress the distribution of a movie, and in the process do damage to our company, our employees, and the American public," Sony Pictures said in a statement Wednesday. "We stand by our filmmakers and their right to free expression and are extremely disappointed by this outcome."

White House spokeswoman Bernadette Meehan said the U.S. government had no involvement in Sony's decision, adding that artists and entertainers have the right to produce and distribute whatever content they want in the U.S.

"We take very seriously any attempt to threaten or limit artists' freedom of speech or of expression," Meehan said.

Just how much the cyberattack will ultimately cost Sony is unclear. Sony faces trouble on several fronts after nearly four weeks since the hackers first crippled its computer systems and started dumping thousands of emails and private documents online.

In addition to vanishing box-office revenue from "The Interview," leaked documents could muck up production schedules, experts say. There will be the cost of defending the studio against lawsuits by ex-employees angry over leaked Social Security numbers and other personal information. And then there are actors and talent who just might decide to work at another studio.

Beyond the financial blow, some say the attack and Sony's capitulation has raised troubling questions about self-censorship and whether other studios and U.S. companies are now open season for cyberterrorists.

"Artistic freedom is at risk," said Efraim Levy, a senior financial analyst at research firm S&P Capital IQ. "Are we not going to put out movies that offend some constituencies?"

Here is breakdown of areas where Sony may suffer damage:

BOX OFFICE LOSSES

With a modest budget of about $40 million, "The Interview" had been predicted to gross around $30 million in its opening weekend. Doug Stone, president of film industry newsletter Box Office Analyst, forecast that Sony could have taken in as much as $120 million in U.S. and foreign box office revenue from the film. It also stands to lose tens of millions in marketing costs already incurred.

But Stone is quick to note that this figure is more like a single movie flop, than a spreading corporate disaster. Sony Corp.'s earnings statements show that revenue from its "pictures" segment generated 830 billion yen ($7 billion) last fiscal year.

"Disney wrote down $200 million on the "Lone Ranger" and didn't bat an eye," he said of the rival studio. "So while it would be a significant hit, it certainly wouldn't cause a financial collapse or anything like that."

STIRRED OR SHAKEN?

A leaked script of the Sony's upcoming James Bond film "Spectre" has led to online media frenzy of articles warning readers of "major spoilers."

Seth Shapiro, a professor at the University of Southern California's School of Cinematic Arts, thinks the potential damage from a hit to the blockbuster franchise is big.

"How can they proceed if everyone in the audience has already read the script?" he said. "You basically need to start over and see how much you can salvage."

Others disagreed, noting that people flooded to movies like the "Titanic" though everyone knew the ending. And they question how many people would pore through details of the movie anyway.

"Most people don't read scripts ... it's not like someone won't go to a movie," said veteran publicist Howard Bragman. "The Bond movie is going to do just fine."

FLEEING TALENT?

It's not yet clear if the deepening scandal touched off by sensitive email leaks will cause agents and top actors to think twice about working with Sony. In the short term at least, some think it may hurt, not only because of the insults related to some big actors like Angelina Jolie, but because the massive leak hurts prestige and indicates Sony is not being run as well as it needs to be, said Shapiro.

"As a place to work, it's definitely not going to be at the top of everybody's list," he said. "Is Sony going to be the place of first resort for Hollywood A-List? No. Not tomorrow."

Others say business interests will trump concerns.

"Studio people are always saying negative things about talent," said Gene Del Vecchio, a marketing professor at University of Southern California's Marshall School of Business. "Apologies are going to be made, relationships will be sustained. Ultimately it's about business ... that will outweigh the insults."

Adds Bragman: "Sony's going to get the talent. They've got a lot of producers on the lot and they're a force to be reckoned with. I'm not imagining the A-list will say 'No, I'm not going to be in business with Sony,' that's naive. "

But all bets are off if Sony decides to reshuffle the top executives at the studios. Some have speculated that co-chair Amy Pascal's job might be in jeopardy due to the insensitive nature of some of her remarks in emails.

In an industry based on relationships, major changes at the top can affect projects for years, said Larry Gerbrandt, a principal at entertainment consulting firm Media Valuation Partners.

"In a business that is driven by relationships 'uber alles' this is enormously disruptive in the short term," he said. "If the fallout leads to large scale changes at the senior executive level it will have a ripple effect for several years since it brings to halt most movies currently under development."

Projects have to be written off, replacement executives hired — who will have their own ideas of what movies should be made — and the costs could easily get into the hundreds of millions of dollars, he said.

LEGAL WOES

Earlier this week, four former employees sued Sony for not better protecting their private information from the hackers. The lawsuits seek class-action status on behalf of the nearly 50,000 Sony Pictures employees whose Social Security numbers and other private data was exposed.

Legal experts said the cases are likely just two of many that will be filed over the data breach. A review of 32,000 emails from the inbox of Sony Entertainment CEO Michael Lynton that were dumped by the hackers on Monday showed the studio suffered significant technology outages it blamed on software flaws and incompetent technical staffers who weren't paying attention. Hackers targeted executives to trick them into revealing their online credentials.

The stolen files expose lax Internet security practices inside Sony such as pasting passwords into emails, using easy-to-guess passwords and failing to encrypt especially sensitive materials such as confidential salary and revenue figures, strategic plans and medical information about some employees. Experts say such haphazard practices are common across corporate America.

Sony potentially faces tens of millions of dollars in damages from a class-action lawsuit, said Jonathan Handel, an entertainment law professor at the University of Southern California Gould School of Law.

"This is not a 'bet your company' lawsuit but it is a serious matter for Sony both in terms of dollar exposure and public perception of the brand," Handel said. "This doesn't look good for Sony, which after all is a technology company."

In addition, Sony may face fines from government regulators and lawsuits from actors, producers and directors, said Steven S. Rubin, a New York cybersecurity lawyer with the firm Moritt Hock & Hamroff.