PlayStation Network Account Security Controversy Resurfaces After Journalist Says Sony Still Has Not Closed Reported Support Side Weakness
A reported PlayStation Network account security weakness is back in the spotlight after French journalist Nicolas Lellouche said his account was compromised again on May 13, 2026, despite the issue first being publicly documented on December 23, 2025. That timeline is closer to 5 months than 6, but the core concern remains the same: Lellouche says Sony still has not fully fixed a customer support verification process that allegedly allowed attackers to reclaim his account even after passkey and two factor protection were enabled.
The original case became widely discussed late last year after Lellouche published a detailed Numerama report explaining that his account had been taken over twice in the same day. In that article, he said a PlayStation support agent restored his account after asking for his PSN username and an old transaction number, and he later learned the alleged attacker had used that same type of information to claim ownership through support. Lellouche wrote that the attacker told him the transaction number had been found in an older screenshot he had previously posted online.
The new development matters because it suggests the same reported weakness may still be exploitable. According to follow up coverage published on May 13, 2026, Lellouche said his account was compromised again and that the only apparent protective measure added after the first incident was a high risk marker meant to stop customer service from intervening. He now argues that as long as the underlying flaw remains unchanged, the same method can be used repeatedly, leaving users unable to trust the long term safety of their digital libraries.
What makes the situation more troubling is that this appears to sit outside Sony’s public facing account security promises. PlayStation’s official support pages continue to recommend passkeys, email recovery, password resets, and compromised account recovery steps, but the public documentation reviewed here does not describe any revised support side identity verification system for cases where a human agent is asked to transfer account control. That does not prove Sony changed nothing internally, but there is no clear public statement from PlayStation showing that the specific support process raised in December was overhauled.
That distinction is important. Passkeys and two factor authentication are designed to protect account access at the login layer. The reported PlayStation problem, if described accurately, is not a failure of passkey technology itself. It is a failure of account recovery and support verification, where an agent can allegedly be convinced to override stronger protections using older account related details. In practical terms, that means users can do everything Sony publicly recommends and still remain exposed if the support side process is weak enough. This is an inference drawn from Lellouche’s reporting and Sony’s current public support guidance.
Sony has not issued a public detailed rebuttal or transparent technical explanation in the sources reviewed here, which is one reason the controversy continues to resonate. For PlayStation users, the takeaway is uncomfortable but straightforward: avoid posting screenshots or purchase details that expose transaction information, keep passkeys enabled, and treat even seemingly harmless account or billing identifiers as sensitive. Until Sony clearly explains what has changed in its support workflow, confidence in the safety of account recovery will remain under pressure.
Do you think Sony needs to publicly explain exactly how PlayStation support verifies account ownership now, or should it quietly fix the process first and speak later?
