The ICO found that the attack was preventable "if the software had been up-to-date," and passwords were not sufficiently protected. "The penalty we've issued today is clearly substantial," said Deputy Commissioner and Director of Data Protection David Smith, "but we make no apologies for that. The case is one of the most serious ever reported to us. It directly affected a huge number of consumers, and at the very least put them at risk of identity theft."
Sony plans to appeal the ruling, according to a statement passed on by BBC reporter Steph McGovern.