Sony is investigating a suspected security issue with the PSN Family Management feature. Multiple users reported that unauthorized, unfamiliar accounts were added as their "child family members." Passwords and two-step verification apparently failed to prevent this action, but Sony has not yet confirmed the specific method or technical cause.
The risk is related to the permission design of the PlayStation Family system. Depending on parental control settings, child accounts may play games from the account and may also purchase content from the PlayStation Store using linked payment methods. Some users are also concerned that unfamiliar accounts might access personal information such as names and profile details.
Once an unusual account is added, users find it difficult to handle the situation themselves. Sony's Family Management help page states that adult family members can be removed, but child members cannot be directly deleted from the family; their status can only be changed after they reach the appropriate age and upgrade to an adult account. In a similar case three years ago, an unfamiliar child account made purchases using the user's credit card; while users could adjust settings to block future purchases, they could not directly remove the account.
Recent reports mainly come from Japanese users, but this issue is not limited to Japan. During the investigation, users can check their family member list and keep two-step verification enabled; if they find unfamiliar accounts, they should contact PlayStation Support for assistance. The current claims of "two-step verification being bypassed" are still based on user reports and should not be considered a vulnerability confirmed by Sony.