Sony Pictures hack spreads to Deloitte: thousands of audit firm's salaries are leaked
The Sony Pictures hack that has sent the Hollywood mega-studio into chaos is spreading far beyond the film industry, as hackers appear to have released documents containing detailed salary information for more than 30,000 employees of Deloitte, the New York-based auditing and professional services firm.
Along with the files smuggled out of Sony Pictures this week, we also discovered a cache of documents apparently relating to internal personnel matters at Deloitte. This appears to be an accident of circumstance. The files appear to come from a single target’s computer. While this person appears to be currently employed in human resources at Sony Pictures, the employee had previously worked at Deloitte, and had saved some files. These were exfiltrated with the other documents by the alleged hackers, who call themselves Guardians of Peace.
Included among the Deloitte files is a spreadsheet that appears to contain the 2005 salary information for 31,124 U.S. Deloitte employees. The same spreadsheet also contains race and gender data for each worker, although unlike the Sony Pictures files, names are not attached to the salary information. If the spreadsheet is accurate, the data provides a rare look inside a high-profile firm’s salary structure.
The data includes salaries from many Deloitte divisions – including Deloitte Tax LLP and Deloitte Consulting LLP, as well as Deloitte & Touche, the firm’s auditing arm. (Deloitte does not appear to be Sony Pictures’ primary independent auditor – that would be PricewaterhouseCoopers Aarata.) The two companies have worked together in the past – recently, for example, Sony Pictures hired Deloitte for a project that used data analysis to determine the effect of social media posts on DVD sales – but the hacked data does not appear to be related to any official partnership between the companies.