The spin is amazingly bad here. Sony says all personal information is compromised, but people in this thread seem to disagree. That is amazingly bad.
Ok onto the people who have issues with putting Sony's share of the blam on them. I can't explain how it went down, but it has been blindingly obvious huge parts of the PSN security was maintained through the PS3 being trusted. This is shown with the exploits such as reseting trophy data, leader board scores, etc that have run rampanty since the PS3 was hacked. Linked to this? Maybe, maybe not. A sign of shitty security? Absolutely. PC has been as open for ages and this shit doesn't happen on, say, Steam or Impulse.
Moving on, the data actually stolen screams bad security as well. Passwords? They got passwords somehow? Security 101 is you encrypt the fuck out of passwords. Any decent system won't be able to divulge it to the systems admin. They are locked away and stored in parts only accessed while verifying the password itself. This, in and of itself, is not really that bad. It is a huge sign of sloppy security though.
Next we have the fact that the CC info itself was stored without needing to exploit an entirely different system screams at me. Admittedly, I have not ever implemented a security system that saves CC info. I will concede any point to rocketpig if he disagress, but there is no way the systems should be remotely similar in terms of security. Completely different, and much tighter security measures should have been utilized to store that data. No way should getting access to the personal info. I certainly wouldn't have my name on such shitty security implimentation.
Finally we come to the worst part of it all. Informing the users. There was a potential security breach that causes a widespread panic and shut down? Inform all the users. That day. If nothing comes of it, great. You tell them immediatly that personal information was leaked though. Log-in and password combinations are used in multiple places by almost everyone to a certain degree. Hell I will keep the same one for bullshit like email or this site. There is no excusing the delay at all. The "panic" caused is considered an accpetable loss by the company. Yes your reputation takes a potentially un-needed hit, but it is an entirely warranted one.
Sony promised to keep the personal information secret, and then failed to deliver on the promise. There is no room for equivication there. Parts of this are as black and white as a newspaper, and that is one of them. Sony failed in their job. The person who breached the secutiry is absolutely to blame as well, but not solely. Sony failed in their due diligence just as badly as the intruder failed in following laws. Both parties are to blame, and I invite someone to argue otherwise as you have some misconception about what is going on here. I will gladly try to illuminate the other side as someone who has been responsible for network security. If this happened to my network I would absolutely hold myself accountable, and take my well deserved share of the blame.