Although the vigilante hacker group Anonymous is denying involvement, Henry says nothing can be ruled out right now. Anonymous had been in a sort of feud with Sony due to the company's lawsuit against a hacker who had released code to make it possible to run homemade games on PlayStation 3 as well as pirated software.

But PlayStation users need to be aware that the massive haul of their personal data means "everything is there for full-blown identity theft, except the Social Security numbers," Henry emphasizes.

Henry predicts there will likely be phishing campaigns by the attackers -- or whoever buys the stolen personal information from the attackers -- to try to get those Social Security numbers. With Social Security numbers, it's not hard to commit financial fraud related to loans or new credit cards, for instance. Henry urges PlayStation victims to contact the three credit-reporting agencies to put a "credit alert" on their accounts so that "no credit can be established without your notification and consent."

In its own advisory yesterday, Sony mentioned the three U.S. credit bureaus -- Experian, Equifax and Transunion -- but urged some caution in using this "fraud alert" mechanism.

"This service can make it more difficult for someone to get credit in your name," Sony Computer Entertainment and Sony Network Entertainment said in its statement yesterday. "Note, however, that because it tells creditors to follow certain procedures to protect you, it also may delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file."