A prominent PlayStation community member known as RealRadec had his PlayStation Network account hijacked this week, exposing a security vulnerability in Sony’s account recovery system that remains unaddressed months after a similar high-profile incident. The hack underscores a fundamental flaw: PlayStation’s customer support can be used to bypass two-factor authentication entirely.
RealRadec, a content creator with over 30,000 followers on X, discovered on 3 October that his account’s 2FA had been disabled. He attempted to log back in, reset his password, and re-enable 2FA — but the attacker had already changed the email address linked to the account, locking him out completely. PlayStation’s support phone line was offline, leaving him with no immediate recourse.
The Same Exploit as Before
The attack vector is identical to the one that compromised Colin Moriarty’s account earlier in 2026. Moriarty, host of the Sacred Symbols podcast, had his PSN account stolen during a livestream. The subsequent investigation revealed that hackers needed only mundane information — a PSN username, an associated email address, and a transaction date or purchase history — to convince PlayStation support to manually reset the account’s email address.
No password was required. No 2FA code was needed. The support representative simply accepted the basic details as proof of identity and handed over access.
The vulnerability: PlayStation’s account recovery process accepts standard data — PSN IDs, email addresses, purchase dates — as identity verification. This creates a bypass around 2FA entirely, since support can manually reset the linked email without requiring a verification code.
“They trick Support (easily) into manually resetting the account’s original email address to theirs,” one user explained. “No password needed nor 2FA.”
Connections Matter — Most Users Aren’t So Lucky
RealRadec eventually recovered his account with help from Moriarty, who leveraged his industry connections to escalate the issue directly to Sony. The two collaborate through Moriarty’s podcasting network, Last Stand Media.
But Radec was candid about his privileged position. “It would be foolish of me not to acknowledge that this was dealt with as quickly as possible because of the position I’m in,” he said. “I want to thank everyone who reached out to me offering their assistance, advice and words of encouragement.”
“My PlayStation account has been hacked. After trying to log in and change my password multiple times, sign out of all devices, re-enable 2FA, nothing worked. They still managed to change my proper email address for my account.” — RealRadec
For ordinary users without industry connections, the situation is far worse. Multiple reports from non-prominent players indicate that once their accounts were stolen, they were never able to recover them. The support system that was meant to help legitimate users regain access has become the very mechanism attackers exploit.
Why the Vulnerability Persists
The root cause is a tension between security and convenience. Account recovery systems need to allow legitimate users to regain access when locked out — and the simplest verification is asking for information only the real owner would know. But when that information is as basic as a purchase date or email address, it becomes trivially easy for attackers to provide.
Some comments on RealRadec’s posts suggest PlayStation support has improved slightly in recent weeks, with some users reporting successful account recovery after providing basic verification materials. But the fundamental architecture — allowing support to override 2FA with minimal proof — remains unchanged.
What Players Can Do
Until Sony addresses the structural vulnerability, the best defence is minimising the information available to potential attackers. That means being cautious about sharing purchase history, linked email addresses, or PSN IDs publicly. It also means documenting transaction IDs and purchase dates in a secure location, so legitimate recovery is faster if the worst happens.
But the responsibility should not fall entirely on users. A security system that can be bypassed by providing a username and a game purchase date is not a security system — it is an open door. Sony has known about this vulnerability since at least May 2026. Five months later, it remains unpatched.
