Sources: 7 linked sources, checked 2026-10-28. Report an error

Sony says it is investigating reports that PlayStation Network accounts are being hijacked through child accounts the owners never created. Affected players say the accounts appeared in their PlayStation Family groups even with a password and two-step verification (2SV) turned on. Sony has not explained the cause, said how many accounts are affected, or confirmed a fix.

Until it does, the practical risk is clear from Sony's own help pages: a family manager cannot remove a child member, and passkeys stay on an account until they are removed by hand. If you use PSN on a PS5, PS4, PC or the PlayStation App, check two menus today: Family Management and Security > Manage Passkeys.

What is confirmed

  • Sony is investigating. Sony told Japan's Sankei Shimbun on 26 Oct 2026 that the matter is "under investigation". The paper says reports started in early October.

  • The accounts bypassed passwords and 2SV, according to users. Sankei and GamesRadar+ both report that affected owners had these protections enabled. Sony has not confirmed how the accounts were added.

  • Child members can't be removed by the family manager. PlayStation Support's family page says: "child members cannot be removed from your family." That is why a planted child account is hard to get rid of.

  • Passkeys are managed separately from passwords. Sony's passkey guide lists Remove next to each passkey under Account Management > Security > Manage Passkeys.

What to check now

Infographic listing five PSN account checks: Family Management, Manage Passkeys, sign-in ID and password, 2-Step Verification and contacting PlayStation Support
NextPlayIntel infographic built from PlayStation Support pages and Sankei Shimbun's report.

Where

What to do

Why

Account Management > Family Management

Look for child members you did not add

The reported takeovers add unknown children; you can't delete them yourself

Account Management > Security > Manage Passkeys

Remove every passkey you don't recognise

A security researcher warns attacker-added passkeys can survive a password change

Security > Sign-in ID and Password

Change them if anything looks wrong

Cuts off anyone using your old details, but doesn't remove passkeys

Security > 2-Step Verification

Turn it on and keep the backup codes offline

Still Sony's main sign-in protection

PlayStation Support

Report unknown child accounts and charges

Support is the only route to remove a child member

On a PS5 the same settings are under Settings > Users and Accounts > Account > Security. Also review the payment methods and transaction history on your account.

The passkey warning

A security researcher who says he reported a PSN family-account flaw through PlayStation's bug bounty programme warned on X on 26 Oct that "changing your email address and password alone won't invalidate attacker-added passkeys", as reported by TweakTown. He says the underlying flaw has been fixed but that child accounts added through it remain. Sony has not confirmed either point, so treat both as unverified.

Two white PS5 Slim consoles, one with a disc drive and one Digital Edition, standing upright beside a white DualSense controller
Image: Sony Interactive Entertainment (official PS5 product image).

What we don't know yet

  • How the child accounts were added, and whether 2SV was actually bypassed or sidestepped another way.

  • How many accounts are affected, and in which countries. Sankei's report centres on Japan, but English-language players have posted the same problem.

  • Whether any payment or personal data was exposed, and whether other Sony services that use the same account are affected. Sony has not said.

  • Whether Sony will remove planted child accounts automatically or refund unauthorised purchases.

Sony has not published a statement on PlayStation.Blog. We will update this story if it does.

Regional note: the first reports came from Japan, but the menus and fixes above are the same on every PSN region, including India.

Sources & verification

Sources last verified on . This article covers published information, not hands-on testing.

Editorial & update notes

Published 28 Oct 2026 with primary-source citations.

Our editorial standards and corrections policy