PSN Family Hack: Sony Investigates Child Account Exploit

Sony is investigating reports that attackers have been adding unauthorized child accounts to PlayStation Network (PSN) users’ Family Management groups, a flaw a Dutch security researcher says he reported to PlayStation through its HackerOne bug bounty program and was paid $5,000 for.

Victims say the accounts appeared without any password or two-factor authentication (2FA) prompt. Because PlayStation does not allow a family manager to remove a child member, many are still stuck with intruders even after the underlying bug was fixed.

Sony confirmed to the Japanese newspaper The Sankei Shimbun that it is looking into the reports, but has not issued a public statement on the cause, the number of affected accounts, or what data was exposed. Japanese outlet Game Watch traced the first cases to at least 6 October 2026, and complaints spread across X and Reddit between 24 and 26 October as players in Japan, the US, and Europe found strangers listed in their PSN families.

How the PSN Child Account Exploit Worked

The researcher, who posts on X as @baas and on HackerOne as 0xbaas, filed a report with PlayStation describing how child accounts could be added to other people’s families without authorization, exposing those users’ private email addresses and full names.

A screenshot of the report rates it High severity with a CVSS score of 8.6 and lists it as Resolved (Closed). The total reward shown is $5,000, and the report records a $2,000 bonus PlayStation approved after the researcher retested the fix, citing the significance of the findings.

The full technical write-up has not been disclosed, as is standard while Sony Interactive Entertainment completes its investigation. The report’s title, however, explains why the flaw mattered.

Family Management on PSN lets a family manager run parental controls, spending limits, and communication settings for child accounts, and a child account can spend from the manager’s PlayStation wallet within an assigned limit, which is zero by default. A planted child account gave an attacker a foothold inside the victim’s family, and with it, the victim’s real name and the private email address tied to their PSN sign-in.

Those two details are exactly what an attacker needs to pose as an account owner. The researcher told Dutch outlet ICD that after describing to PlayStation Support content purchased on those child accounts, he was able to have the family manager’s main account handed over through support, even when 2FA or passkeys were enabled. He said the vulnerability itself has been fixed, but the child accounts added through it remain in the victims’ families.

Why a New Password and 2FA May Not Lock Attackers Out

On 26 October 2026, the researcher said on X that he was receiving a flood of messages from gamers whose PSN accounts had been hacked, that he was not permitted to discuss the case yet, and that PlayStation was working on it. His one piece of public advice targeted passkeys, the passwordless sign-in method PlayStation added in 2024.

Passkeys “are tied to the account itself,” he wrote, so changing the email address and password does not revoke a passkey an attacker registered. That leftover passkey lets the attacker sign back in without requiring a password or 2FA.

In December 2025 and again in May 2026, PSN accounts were hijacked by attackers who convinced PlayStation Support they were the owners using a PSN ID and a single transaction detail, a method that also bypassed 2FA.

Podcaster Colin Moriarty lost his account that way in May, and content creator RealRadec reported the same takeover on 3 October 2026, days before the first reports of child accounts surfaced. The family flaw handed attackers the identifying details and purchase history that this recovery process accepts as proof of ownership.

What PSN Users Are Reporting

A Japanese user posting as BA said six child accounts were created on his family at the same moment on 11 October, all set to the American Samoa time zone, and that PlayStation’s LINE support channel referred him to phone support.

A Reddit user reported five unknown child accounts on their main account, along with account-change notifications and a $0 Roblox purchase. Others say they woke up to emails confirming that their PSN sign-in ID had been changed.

Some accounts on X have gone further, claiming that birth dates, phone numbers, and home addresses were also visible. Neither Sony nor the researcher has confirmed that; the HackerOne report names only email addresses and full names.

Cleanup is the bigger problem. Sony’s own support documentation states that “child members cannot be removed from your family,” and an adult cannot leave a family they did not create without support stepping in. Victims who discover planted accounts currently have to contact PlayStation Support to have them removed.

How to Check and Secure Your PSN Account

On a PS5, go to Settings, then Family and Parental Controls, then Family Management, or sign in to Account Management on the web and open Family Management. Any child or adult member you do not recognize is a red flag.

Take screenshots with the account names before you contact PlayStation Support. Until support removes them, set each unknown child account’s monthly spending limit to 0 and disable its communication features in the same menu.

Next, check your passkeys, which is the step most guides miss. In Account Management, go to Security, select Manage Passkeys, and remove any passkey you did not create yourself. Then change your PSN password, change the password on the email account linked to PSN, and use the option to sign out of all devices to end active sessions. Keep 2FA switched on.

Finally, review your transaction history for purchases you do not recognize and turn on Require Password at Checkout in your PlayStation Store settings. Because the support-desk takeovers rely on purchase details, avoid posting screenshots of receipts, transaction IDs, or order emails online.

Sony has not said how many accounts were affected, whether personal data was harvested at scale, or when family managers will be able to remove child accounts they never created. The researcher has said he will continue sharing what he knows with PlayStation, and the HackerOne report remains undisclosed while Sony completes its investigation.