Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
If you suspect your PlayStation Network (PSN) account was taken over, use Sony’s official recovery process, then check more than your password: remove unfamiliar passkeys and family members, secure the email account linked to PSN, and turn on two-step verification (2SV) with backup codes recorded safely. October 2026 reports described unauthorized child accounts and passkeys that could remain usable after an email and password change. Sony has not published an affected-account count or a public postmortem, so treat an unfamiliar account setting as a warning sign—not proof of a confirmed PSN server breach.
What is the security concern, and what has Sony confirmed?
Reports in October 2026 described PSN users finding child accounts they did not add to Family Management, as well as attacker-added passkeys that could persist after a victim changed their email and password. Earlier reports in 2025 and 2026 described attackers persuading PlayStation Support to change an account’s sign-in email using personal account or purchase details. These are different account-security problems; the reporting does not establish that Sony’s PSN servers were breached.
As an Amazon Associate I earn from qualifying purchases.
Sony has not published an official postmortem or a number of accounts affected by the October family-account reports. Cyber Kendra reported that security researcher baas (0xbaas) received a $5,000 HackerOne reward for a high-severity issue rated CVSS 8.6, including a $2,000 bonus after a retest. That is a report about a vulnerability and its disclosure, not an official count of affected users or confirmation that every reported account was affected. Sony was reported to be investigating; there is no public Sony advisory confirming the cause, a final remediation status, or the scope.
The immediate practical lesson is narrower and more useful: after recovering an account, inspect account state, not just credentials. A changed password does not necessarily remove a passkey registered by someone else, and an unknown child member may remain in a family until Support removes it. Sony’s own security-settings guide warns: “Sharing your PlayStation details can compromise your account security. Always ensure that your password and account details are kept secret and safe.”
Popular on Amazon
What should I do first if my PSN account was hacked?
Use only PlayStation’s official recovery service. If you can still access the sign-in email, start with self-service account recovery; if the email, verification details, or sign-in method were changed, contact PlayStation Support through its Online Assistant. Do not pay a third party or follow recovery links sent unexpectedly by email or direct message.
- Type Sony’s address yourself. Go to Account Management, or open the official Account & Security hub and use its recovery links.
- If you still control the linked email, try self-service recovery. Choose Trouble Signing In? and then Recover Your Account (or Reset your password). Enter your sign-in ID, which is the email address associated with the account, and follow the secure link Sony sends. Sony says the email may take a few minutes to arrive. Create a new, unique password using uppercase and lowercase letters, numbers, and special characters.
- If 2SV is on but you lost access to your phone, use a backup code. On the sign-in flow, choose Trouble Receiving Code? and then Sign In Using a Backup Code. Each of the 10 codes issued when 2SV is set up can be used once.
- If you cannot use a synced passkey, try a device that already has it. Sony’s passkey guidance says to sign in on another device where the same passkey or password manager is available, then register a new passkey. If you cannot do that, use the Online Assistant.
- Escalate when account details changed without your permission. Use PlayStation Support’s recover-account page or sign-in troubleshooting to reach the Online Assistant if you no longer have the linked email, forgot account-verification details, cannot open a reset or 2SV email, received unexpected 2SV messages and cannot change the sign-in method, or have neither a phone nor backup codes.
Sony may request identifying documentation if it reasonably suspects an account is compromised, as described in section 3.6 of its U.S. Terms of Service. Have relevant details ready for Support privately—such as your online ID, sign-in email, purchase history, and identifiers for a console you legitimately own. Do not post them publicly or send them to an unsolicited account claiming to be Support. Only Sony can restore access to a PSN account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why should I check passkeys after changing my password?
A passkey registered by an attacker may remain attached to the PSN account after you change the password or sign-in email. After regaining access, open Security > Manage Passkeys and remove every passkey you do not recognize; changing credentials alone is not a substitute.
On the web, go to Account Management > Security > Manage Passkeys, then select Remove beside an unfamiliar passkey. Remove only entries you cannot identify. If you want to keep using passkeys, register a new one on a phone or other device you control, using Security > enable Sign in with Passkey > Create a Passkey. Sony sends an email confirmation when a passkey is created, so an unexpected confirmation can be a clue that someone added one.
Also popular on Amazon
On PS5, the setup route is Settings > Users & Accounts > Account > Security > Sign in with Passkey; scan the QR code with your phone and create the passkey there. Sony lists passkeys as working on PS5, PS4, the PlayStation website, PlayStation App, and Remote Play for Mac. PS3 and PS Vita instead use a device setup password. Sony warns that some hardware security keys may encounter issues and recommends considering synced passkeys on mobile devices.
PlayStation Support promotes passkeys as a password replacement, but they are not an automatic cleanup mechanism: check the account’s registered passkeys after a suspected takeover. Researcher baas told TweakTown that passkeys are tied to the account, so an attacker-added passkey can survive a password and email change. That is the reason to inspect and remove unfamiliar credentials directly.
How do I remove an unauthorized child account from Family Management?
Check Family Management as soon as you regain access. An adult you did not add can be removed by the family manager; an unknown child account cannot be removed through the family manager’s controls, so contact PlayStation Support and set that child’s monthly spending limit to zero while you wait.
Open Family Management on the web through Account Management > Family Management. On PS5, go to Settings > Family and Parental Controls > Family Management. Make a private record of unfamiliar names and account details, then review each member:
Also popular on Amazon
- Unknown adult: Select the member and choose Remove from Your Family. Sony says adult members cannot spend the family manager’s wallet.
- Unknown child: Set the monthly spending limit to 0 and contact official Support for removal. Sony’s family-account guide states: “Please note, child members cannot be removed from your family.” A child account has no separate wallet and can spend from the family manager’s wallet only within the assigned limit; the default monthly limit is zero.
An unfamiliar member is reason to investigate, but the available reports do not establish that a planted child account automatically gains access to saved card details, passwords, or private messages. Do not assume those items were exposed based only on the member’s presence; review transactions and account settings separately. Sony has not publicly confirmed the cause or extent of the family-account reports.
How do I secure the account after I can sign in?
Work through these steps in order. Secure the linked email first, then remove unauthorized account access, review family and payment settings, and rebuild your sign-in protection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Secure the email mailbox linked to PSN. Change that mailbox’s password from a device you trust and review its own recovery and sign-in settings. PSN password-reset and 2SV messages go to that address, so an attacker who controls the mailbox may be able to interfere with recovery.
- Review Family Management. Remove unknown adults, set unknown children’s monthly spending limits to zero, and contact Support about child-account removal. Tighten communication and privacy settings if they are relevant to your household.
- Remove unfamiliar passkeys. In Account Management > Security > Manage Passkeys, remove entries you did not create. Only then decide whether to register your own passkey on a device you control.
- Change the PSN password. Choose a password not used for another account. Sony’s security settings are available on the web at Account Management > Security; on PS5, use Settings > Users and Accounts > Account > Security; on PS4, use Settings > Account Management > Account Information > Security. Sony says security-setting changes apply across devices and consoles.
- Check the sign-in ID. If it was changed without permission—or you need to replace the email tied to PSN—go to Security, choose Edit beside Sign-In ID (Email Address), and verify the replacement email using Verify Now. Sony says changing the sign-in ID signs you out of all devices. The old inbox also receives a change notice, if it remains accessible.
- Enable 2SV, preferably with an authenticator app. On the web, choose Edit beside 2-step Verification Status under Security. Sony’s setup instructions support text-message codes and authenticator apps, naming Authy, Google Authenticator, and Microsoft Authenticator. If choosing an app, scan the QR code or enter the alphanumeric secret, then activate 2SV. Sony’s setup guide says verification codes are valid for 10 minutes after a sign-in attempt.
- Record the backup codes immediately. Sony issues 10 one-time backup codes during setup. Save them somewhere private and accessible if the phone is lost; do not keep the only copy on the phone that generates your codes. Sony says: “Without a record of these codes, you need to verify your identity to recover your account.” You can view codes later under Security > Backup Codes only while you can still sign in. If you have used most of them, Sony’s guidance says to turn 2SV off and back on to receive a fresh set; doing so invalidates the remaining old codes.
- Review wallet activity and saved payment methods. Check transaction history and payment settings for activity you do not recognize. A child account can spend from the family manager’s wallet up to its monthly limit, so check that limit as well as transactions. For unauthorized charges, contact PlayStation Support through the official Account & Security hub; do not rely on a refund outcome that Sony has not confirmed for your situation.
On PS5, the 2SV menu is Settings > Users and Accounts > Security > 2-Step Verification. On PS4, it is Settings > Account Management > Account Information > Security > 2-Step Verification. Sony may request 2SV at the first sign-in after enabling it, after you manually sign out, after a password reset, and after changing your sign-in ID or online ID.
Which is safer: SMS, an authenticator app, or a passkey?
These options protect sign-in differently, and none replaces checking the account after a suspected takeover. In the 2025–2026 support-impersonation reports, attackers persuaded Support to change account email details using information about the owner; that process could bypass a password and 2SV challenge. An authenticator app is a stronger choice than SMS in this context, while a passkey requires careful review for unfamiliar entries.
Also popular on Amazon
| Method | What Sony supports | Practical trade-off |
|---|---|---|
| SMS 2SV | Supported by PlayStation | Convenient, but phone access can be lost and support-impersonation reports included phone-loss or SMS-related scenarios. Do not treat it as equivalent to an authenticator app for this incident pattern. |
| Authenticator-app 2SV | Sony names Authy, Google Authenticator, and Microsoft Authenticator | Avoids relying on text-message delivery. It still cannot prevent a Support-assisted account change if identity checks are socially engineered, so protect account-recovery details and retain backup codes. |
| Passkey | Officially promoted as a password replacement; Sony emails confirmation when one is created | Use only devices you control and periodically review Manage Passkeys. An attacker-added passkey may remain valid after an email and password change until you remove it. |
For a passkey, use a device you control and a recovery method you can retain. Sony’s passkey guidance cautions that some hardware security keys may encounter issues and suggests considering synced passkeys on mobile devices. If your account is already compromised, first remove unfamiliar passkeys; adding a new one without doing that leaves the old credential in place.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What information should I keep private when contacting Support?
Share account-recovery information only through official PlayStation Support channels, not in public posts or unsolicited messages. Reports from December 2025, May 2026, and early October 2026 described attackers using a PSN ID, linked email, transaction number, or purchase date to persuade Support to reset an account’s sign-in email.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do not publish your PSN ID together with your sign-in email, transaction IDs, receipts, order emails, console serial numbers, or the last four digits of a payment card. Details that seem harmless individually can help someone impersonate you when combined. PlayStation’s U.S. Terms of Service, section 3.3, says users should safeguard their sign-in ID, password, passkey, and other authentication information, including on shared devices. Section 3.4 says Sony may take protective actions if it believes an account is compromised, including resetting passwords or revoking passkeys.
Be suspicious of unsolicited “support” messages and recovery services that ask for credentials or payment. Type playstation.com yourself and navigate to Support. A third party cannot legitimately restore your PSN account, and unexpected links can lead to credential theft rather than recovery.
Also popular on Amazon
What should I do if the menus or recovery process do not match?
Use the official Support pages rather than relying on an old screenshot or a link from a social-media post. The procedures here are based on U.S. English PlayStation Support pages reviewed in October 2026; labels and identity checks can change. If a menu label differs by console software or region, use the Account & Security hub and search for the relevant official support topic.
Keep the distinction between what is documented and what is reported in mind: Sony documents passkeys, 2SV, backup codes, family-member controls, and sign-out behavior after a sign-in ID change. As of the research date, Sony had not posted a public explanation of the October unauthorized-child-account reports, an affected-account count, or confirmation that family members could access payment cards. Do not infer an account-wide breach from an unfamiliar setting, but do treat it as a reason to secure the account and contact Support.
Frequently Asked Questions
Does this mean PlayStation’s servers were hacked?
The October 2026 reporting describes account and support-process issues, including unauthorized family members and lingering passkeys; it does not establish a PSN server breach. Sony had not published an official postmortem or affected-account count as of the research date.
Can Sony Support turn off 2SV for me?
If you lost the 2SV device and have no backup code, Sony’s recovery guidance directs you to PlayStation Support’s Online Assistant for identity verification. Do not give a verification code or password to someone who contacts you claiming they can disable 2SV.
What does CVSS 8.6 mean in the report about the family-account issue?
CVSS is a standardized way to describe a vulnerability’s severity, and 8.6 falls in the high-severity range. The score does not tell you how many accounts were affected or prove that every PSN family account is vulnerable.
Can I use the same passkey on PS3 or PS Vita?
Sony’s compatibility guidance lists PS5, PS4, PlayStation website, PlayStation App, and Remote Play for Mac for passkeys. PS3 and PS Vita use a device setup password instead.
