Sony investigates reports of PSN child-account security flaw

Sony is reportedly investigating a PlayStation Network security issue after users said unfamiliar accounts were added to their family groups as child members, potentially exposing account information and creating a route to purchases through linked payment methods.¹

The reports, first highlighted through a machine-translated statement sent to The Sankei Shimbun, describe unauthorised “child family members” appearing on affected accounts despite the owners using passwords and two-factor authentication.¹ GamesRadar reports that the problem appears to be affecting a notable number of Japanese users, although it is not necessarily limited to Japan.

What is happening

PlayStation family groups allow an adult family manager to create or add child accounts, manage playtime and set spending limits. Sony’s own family-account guidance says child members cannot simply be removed from a family group, while adult members can be removed.² That restriction is at the centre of the concern: if an attacker can add a child account, the legitimate account holder may have limited control over removing it.

Users quoted in the report said the added accounts could see personal information and, depending on the family settings, potentially buy content using a linked payment method.¹ Those claims remain user reports rather than a confirmed description of Sony’s final root cause. Sony’s investigation will need to establish whether the issue is an account-recovery weakness, a family-management flaw or a combination of both.

The PlayStation Family app shows how much family-management information is exposed through these tools. Sony says parents can view activity, manage playtime, control spending and adjust privacy settings from the app.³ Those controls are useful when the family group is legitimate, but they also explain why an unexpected child account is more than a cosmetic nuisance.

What affected players should do

PlayStation users should check the members of their family group, review recent purchases and confirm that their recovery email, password and two-factor-authentication settings have not changed. Anyone who finds an account they did not add should contact PlayStation Support rather than attempting to guess at a workaround. Payment methods should also be reviewed while the investigation continues.

There is no confirmed evidence in the source report that every affected account has been emptied or that two-factor authentication has been bypassed in the conventional login sense. The more precise description is that users say an unauthorised family member was added without their approval. That distinction matters until Sony publishes a technical explanation.

Our opinion

This is the sort of security report that deserves urgency without exaggerated certainty. Adding an unknown child account to a family group could expose personal details and create financial risk, while the reported removal restriction leaves users feeling trapped. Sony should explain what happened, provide a reliable removal path and notify affected account holders directly if it confirms a vulnerability. Until then, checking family memberships and payment activity is sensible, but the public evidence does not yet justify claiming that every PS5 account is compromised.