I find it odd that while everyone in this thread takes issue with one variable used in reaching this estimate. Nobody seems to have questioned the other applied variable. That being $318 average per malicious act. With a global economy that is climbing out of recession, increased employment, and a willingness by banks to loan. Well it isn't exactly hard to imagine that credit lines have more slack. Further more this average accounts for both organized theft, and petty theft. The truth is the majority of identity theft is chump change. The thefts that clear thousands out of bank accounts, and run up huge debts are the rarity.
In this instance if the invasion did result in a individual or individuals obtaining useable information. What matters isn't how many unique users there actually are. What matters is the intent and caliber of those involved. A fringe group just trying to make a point will not cost Sony much beyond overhauling their system. Which they would have eventually had to do anyway. However if it was a group of organized criminals say the Russian mob. They could very well get the maximum value out of that information. Which means they could cost each victim thousands of dollars.
We just can't say what is a rational or irrational estimate until the damage is done. Yes it could be very light, or it could be simply ungodly. Hard to say with a breach this massive. Beyond that I have no issue with the litigant in the civil suit. He is simply asking for what is basic operating procedure in such situations. Most governments, organizations, and companies offer protection as a matter of coarse. It is simply reasonable to cover losses, and to hire identity protection to ensure against losses. In the end Sony not doing this may have saved them a pretty penny, or it might be what could cause the cost to spiral out of control. Anyway it doesn't make them look good. Hard to see a judge, jury, or mediator not siding with the plaintiff. What is being asked for is entirely reasonable. More to the point Sony should probably try to get an accomodation out there before a government, or governments step in. Which may happen if there was real damage.
Speaking to a EULA I wouldn't hold my breath on that being any real protection. It isn't even necessarily true that such contracts are actually legal. Given that they often mandate things that are patently unlawful. In which case makes them instantly null and void. They are basically barely above shrinkwrap contracts. Only in that they adhere strictly to the law in a few given locations.
Anyway my two cents
