Mashable

World

Hackers sent extortion email to Sony executives 3 days before attack

Sony-email-warning-01
Image: Mashable composite

The hackers behind the massive Sony Pictures breach warned of a damaging cyberattack in a jumbled email sent to company executives three days before the hack.

The email, sent on Nov. 21, was addressed to Sony Pictures CEO Michael Lynton, Chairman Amy Pascal and other executives. Mashable has found the email among a new trove of leaked Sony documents released on Monday by the mysterious group of hackers that some believe to be North Korean.

The email, written in broken English, makes vague references to "great damage" and asks for "monetary compensation" to avoid it.

"Pay the damage, or Sony Pictures will be bombarded as a whole," the hackers said.

The hackers signed the email as "God'sApstls," a phrase that was also found inside some of the malware used in the attack on Nov. 24, which wiped many of Sony's computer systems. The hackers used what appears to be a throwaway Gmail address, similar to other addresses the hackers have used in emails to reporters.

Here's the full email, which was inside files from Amy Pascal's email account that were released by the hackers. It appeared she never read the email.

Hackers' email

We've got great damage by Sony Pictures.

The compensation for it, monetary compensation we want.

Pay the damage, or Sony Pictures will be bombarded as a whole.

You know us very well. We never wait long.

You'd better behave wisely.

From God'sApstls

The Nov. 21 extortion email may partly explain the chilling message that appeared on some Sony employees' computers on Nov. 24. That message, headlined "Hacked by #GOP," made references to a previous, unheeded warning.

"We've already warned you, and this is just the beginning," the message read. In that message, the hackers called themselves Guardians of Peace, or GOP.

The newly discovered email appears to be the first indication that the hackers had a financial motive. It wasn't clear whether they had had previous communication with Sony executives or had specified a dollar amount for their demands.

The email will likely cast even more doubt on the theory that North Korean hackers were behind the attack. The email makes no reference to North Korea or the movie The Interview, and it seems that the main goal of the hackers was to get paid a ransom, not to protest a satirical movie about a plot to assassinate Kim Jong-un.

On Monday, however, in a new message that advertised the latest document dump, the hackers asked Sony to "stop immediately showing the movie of terrorism which can break the regional peace and cause the war!" in an apparent reference to Seth Rogen and James Franco's movie, which the North Korean government has called offensive.

Yet in a profanity-laced exchange with freelance reporter Thomas Fox-Brewster last week, the hackers signed an email with a phrase in Korean that contained errors and did not appear to have been written by a native speaker.

The hackers have exposed hundreds of gigabytes of internal Sony Pictures files. On Sunday, a letter written by Kevin Mandia, the head of the security company hired by Sony to investigate the hack, referred to the attack as "unprecedented," "undetectable" and "unparalleled." But several experts are skeptical of that description, putting the fault on Sony's own security shortcomings.

We have reached out to Sony Pictures for comment and will update the story if we hear back.

Have something to add to this story? Share it in the comments.

Load Comments

What's New

What's Rising

What's Hot