From lockdown-related damage to the erosion of consumer spending power amid spiraling inflation, the entertainment and media industry has faced considerable headwinds in recent years. After weathering the storm, industry revenues rose 5% in 2023 to $2.8 trillion and could exceed $3 trillion by 2028. However, when it comes to protecting the data that underpins it from hacker breaches, resilience often falls short, exposing organizations to disruption, reputational damage, and financial penalties.
These data breaches could be compared to life-imitating art because they resemble blockbuster movies about the murky world of hacking. Organizations in this space must avoid turning successful cyberattacks into big-screen stories by recognizing data’s value and taking proactive measures to safeguard it.
Data breaches in Entertainment and Media
Personal data: a core asset of the industry
From unlocking access to online services to providing deep insights into audience preferences, data is a core asset of the entertainment and media industry.
Powering the shift online
The entertainment and media industry has undergone a digital transformation as it shifted online, accelerated by pandemic-induced lockdowns. This is underscored by the rapid rise of streaming services, which have transformed how content is produced, distributed, and consumed.
These services let consumers watch a vast array of content from home or on the go via smart devices. To access this convenience, they must set up accounts and enter sensitive personal data on streaming sites, including credit card details and emails.
The same pattern holds in online gaming, which has drawn attention for its global revenue. In 2022, the global gaming industry generated an estimated $184.4 billion, compared with the global recorded music and movie industries, which generated around $26 billion each—an eye-watering amount that depends on consumers providing personal data online to sign up for and purchase gaming services.
Leveraging user data to provide a better service
Content is the lifeblood of the entertainment and media industry. Creating engaging material requires access to consumer data that helps companies understand and cater to audience preferences, optimize content strategies, and deliver personalized experiences. Nowhere is this more prevalent than in the streaming world, where platforms like Netflix and Spotify use user data to improve service and marketing.
This process involves different layers of data collection that include third parties:
- The platform collects first-party data directly from its users, including names, email addresses, account details, and subscription plans.
- Partners collect and exchange second-party user data, such as demographic and geographic data.
- Third-party data, including behavioral data, is gathered by specific data providers, for example, for marketing purposes.
Data breaches
The entertainment and media industry’s growing dependence on the internet is exponentially expanding its attack surface, making it an attractive target for cybercriminals. Cybercriminals are after the ocean of personal data exposed by weak cybersecurity controls, an all-too-common scenario that has led to several notable data breaches.
Disney
In July 2024, hackers accessed public and private Slack channels at entertainment behemoth Disney, exposing over 4 million Slack messages, 18,800 spreadsheets, and 13,000 PDFs, and leaking compromised data. Beyond financial data that could be used for ransom, the leak included personally identifiable information about Disney employees and customers, including passport numbers, visa details, and contact information.
Nintendo
In April 2020, Nintendo suffered a data breach that compromised 300,000 customer accounts. The exposed data included credit card information, email addresses, geographic locations, names, and Nintendo Network ID usernames.
Hackers targeted the Nintendo Network ID (NNID) system, which lacked two-factor authentication, using methods like phishing. Having gained unauthorized access to personal information and saved payment details, some users experienced fraudulent transactions on their accounts.
CAM4
In March 2020, the Cam4 data breach was reported as the largest data leakage in history. The adult streaming site exposed over 10 billion data records due to a misconfigured Elasticsearch database, an internal search engine employees used to scan user and activity logs. This left data vulnerable to anyone with an IP address, including first and last names, payment logs, email addresses, and password hashes.
Intellectual property: holding the industry to ransom
The entertainment and media industry runs on creativity. From scripts to the screen, this takes the form of intellectual property (IP), the ownership of creations of the mind, including ideas and designs, such as screenplays, scripts, films, songs, compositions, sound recordings, TV shows, video games, and animations.
In the wrong hands, IP can be leveraged for financial gain by demanding a ransom to prevent its release or sale. Sometimes it’s all bravado, given the high profile of the hacked data. Before they can make fraudulent demands or claim bragging rights in hacking circles, cybercriminals must compromise the data, something they’ve become adept at, as the 2022 Rockstar Games hack showed.
Rockstar Games
In September 2022, a hacker used social engineering to steal an employee’s login credentials at Rockstar Games. They used this information to breach the Rockstar Games network and access the source code for Grand Theft Auto 5 and the in-development version of Grand Theft Auto 6. The hacker then posted on GTAForums, claiming they wanted to “negotiate a deal” with Rockstar Games to return the unreleased data.
Impact of data breaches on the industry
The entertainment and media industry’s reliance on digital platforms, IP, and consumer trust means data breaches can significantly impact organizations – operationally, financially, and reputationally.
- Operational disruption
Data breaches that lead to ransom demands for compromised IP can cripple production schedules, disrupt broadcasting, or delay releases. Third-party risk can also indirectly disrupt operations if a vendor or partner’s sensitive data is compromised.
- Financial loss
Data breaches can cause significant financial losses from ransom payments linked to leaked IP, legal and regulatory penalties under laws like the GDPR, remediation costs, and lost revenue from disrupted operations.
- Reputational damage
Consumers may hesitate to use a streaming platform or buy content from a company that has failed to protect their personal data. High-profile breaches can tarnish a company’s reputation, erode audience loyalty, and damage its brand image.
Preventing data breaches
To protect themselves from data breaches, entertainment and media organizations must adopt a multi-faceted cybersecurity approach that combines three key strategies: robust access controls, employee training, and adherence to best practices.
Access controls
Robust access controls protect sensitive data by regulating who can access it – and under what circumstances. Common controls include:
- MFA
Multi-factor authentication (MFA) offers an extra layer of security when accessing systems and applications. In addition to entering their password, users must provide additional information, such as a code sent to their phone or a biometric scan, to log in.
- Data encryption
Data encryption builds user trust by demonstrating a commitment to maintaining the confidentiality and integrity of submitted data. It harnesses robust encryption algorithms, public and private keys, and a trusted certificate infrastructure.
Employee training
Employees should be empowered to recognize and respond to potential cybersecurity threats that could result in data breaches. This requires training on identifying phishing emails, promptly reporting suspicious activity or potential vulnerabilities, and responding to a cyberattack.
Adherence to best practices
Data handling policies, procedures, and tools provide the structure needed to adhere to best practices. They must be transparent and implemented throughout the organization so everyone understands the correct data management practices, from collection, use, and processing to transfer, disposal, and sharing.
Data: Instilling resilience in the industry
From financial gain to malice and bravado, motivations to compromise data created and held by the entertainment and media industry are multifaceted, amid its ever-widening attack surface and high profile. Whether targeting personal user data for fraud or high-value IP to show off hacking prowess, the industry offers rich pickings for cybercriminals.
This perfect storm of motivation and opportunity amplifies the need for robust access controls, focused employee training, and adherence to best practices. By adopting a comprehensive cybersecurity approach, industry organizations can build the resilience needed to safeguard the data that underpins it.
