Strangers are appearing as children on PlayStation accounts, and the account holder cannot remove them

You open Family Management on your PlayStation account and there is a child in it. Not yours. No sign-in alert, no two-factor code, nothing. The first cases trace back to at least 6 October, and complaints piled up across X and Reddit between the 24th and the 26th from players in Japan, the United States and Europe. Sony has confirmed to the Sankei Shimbun that it is looking into it, and has said nothing yet about the cause or how many accounts are involved.

A Dutch researcher reported the underlying bug to PlayStation's HackerOne programme and was paid 5,000 dollars plus a 2,000 bonus. His account of what it leads to is the uncomfortable part. Planting the child account exposes the family manager's full name and email address, and he says that by describing to PlayStation Support what had been bought on those child accounts, he was able to get the main account handed over to him, with two-factor authentication or passkeys switched on.

Two things make this hard to clean up. A family manager cannot delete a child member, so the intruder stays until support removes them. And a passkey registered by an attacker is tied to the account rather than to a password, which means changing your password and your email address does not evict it.

So if you have a PSN account, open Family Management and look. Then open your security settings and remove any passkey or signed-in device you do not recognise, change the password, and make sure the email address attached to the account has its own strong password and two-factor turned on. That last point is the one people skip, and it is the one that decides whether you get the account back. Tendvane's Privacy and accounts check will tell you whether the email address behind your gaming account has turned up in a known breach.