Aaaaand it's time for some more clarification.
-- 1) While there has been no outright confirmation that passwords were indeed stored in plaintext, the emails from Sony very specifically said passwords had been stolen en masse, and insisted users change them at the earliest convenience. If you securely hash your passwords, they cannot be stolen. It's not one of those "all it takes is one supremely talented hacker" situations - when you hash something, you're not just encrypting it; you're destroying it in such a way that the reverse encryption is entirely impossible, even if you know exactly how you did it. The hashing algorithm is designed to dump huge lumps of data, generate other lumps and produce a string of the same length regardless of the password's original length. Hashed passwords simply cannot be usefully stolen - and all you get if you try is a load of useless gibberish that can't be employed for any purpose in the real world. The very fact that Sony is insisting that passwords were in fact stolen implicitly guarantees the use of plaintext storage, which is such an elementary failure on their part that there is no way to excuse the matter. I hash my passwords, Amazon hash their passwords, you can bet your bottom dollar that the Escapist hash their passwords - but Sony didn't. There is no defence.
-- 2) People get hacked all the time, but there's hacking and there's hacking. If you believe that this could have happened to anyone, consider how often we hear about the personal details of 75m users being stolen in similar attacks. What's that? We don't? That's right, we don't, because you can do a lot more than Sony did to protect the data that was lost. You can do a lot more than Sony did to set up systems to alert you to intrusions. We're being told that it took them an entire week to know what had happened - if sufficient monitoring systems were in place, it would have taken them three hours. I'm not kidding about the timescales here - Sony simply refused to acknowledge the threat that every internet-based service is required to be fully aware of, and as such they didn't have the first clue what to do when the worst happened.
Yes, anyone can get hacked, and compromises on smaller scales do happen, but there are so many things you can do to limit the damage that can be done. The idea that it doesn't matter what you do because the hackers are always going to be better than you is a fallacy - for every brilliant black-hat hacker, there's an equally brilliant white-hat one who spends his life looking for the same security holes and then telling people how to secure them. Entire companies exist just to audit and reinforce cyber security systems, and any responsible online organisation makes use of them on a regular basis, because these companies are just as good at getting in as the bad guys are, and, if used correctly, are generally able to limit the risk to nothing more than harmless intrusion or brief service downtime. The compromises we hear about are invariably in the systems that failed to make a real security effort, but every day there are many more attempts that never get anywhere because proper precautions have been taken. Sony, by their own admission, did not make any use of external auditors before the event - it's a symptom of the fragmented and distinctly paranoid Sony mentality, and they've paid the price for it. If you employ the best in the business to secure your systems, the risk remains minimal. If you don't do anything to secure your systems, you deserve to fail to the first person that probes your network.
