Whether it was North Korea or not, Sony carries much of the blame for this cyber catastrophe. On 24 November, Sony Pictures employees arrived for the day expecting their quotidian working lives to continue uninterrupted. But during that day, a cartoon skeleton popped up on their screens. It warned them in bold text that the Guardians of Peace hacking crew had obtained all Sony Pictures’ data, and unless some unspecified demands were met, that information would be exposed for all to see.

The Guardians followed through, leaking everything from bitchy messages to employees’ healthcare data and social security numbers, and wiping all of Sony’s systems to boot. Cue a cyber nightmare.

Though emails sent to Sony’s senior staff would show that the hackers were initially attempting to extort money, over subsequent weeks the media would fuel speculation that this was an attack by North Korea in response to The Interview, a Seth Rogen flick in which dictator Kim Jong-un has his face melted off and his head blown up. The hackers, either coming clean on their real intentions or diverting attention away from their original sin, demanded the film be pulled and made violent threats of 9/11 proportions. The Interview was subsequently cancelled.

It’s right that law enforcement agencies chase down whoever carried out this attack, whether it was North Korea’s digital forces or some greedy cyber criminals. But Sony’s role should not be forgotten. Its failings have lessons for everyone.

And they were plentiful, bordering on parody. The leaks revealed Sony was storing passwords for internal accounts in a file called “passwords”. This is gold dust to any hacker who has found his or her way on to a network. It gives them the keys to other doors, or in Sony’s case, the kingdom.

Diana Bang, Seth Rogen and James Franco, in a scene from The Interview. Photograph: Ed Araquel/AP

Those at the top of Sony’s hierarchy were guilty of egregious security practices too. Chief executive Michael Lynton’s password, Sonyml3, was easily guessable to any semi-skilled hacker. Let’s not even entertain the possibility that Lynton went through Sonyml1 and Sonyml2 first. If it’s not apparent already, using passwords that contain your employer’s name, your initials and a single number is a rookie error. Everyone’s passwords should be as long as possible and difficult to guess. While a human might have a hard time figuring out people’s login credentials, a computer program with the sole aim of guessing that password as quickly as possible won’t.

The Sony files also included emails indicating that various Sony Pictures properties were hacked this year. Its German website was breached to serve up malware to visitors in January and Sony’s legal team feared the attackers had got their mitts on email addresses and birthdates of more than 47,000 newsletter recipients. Another attack saw contact information on 749 individuals associated with cinemas in Brazil compromised. Though they were far less damaging than the “Guardians” hit, both attacks showed Sony was vulnerable.

Sony could have averted this catastrophe if it had simply protected its data better. If it had used encryption, where plain text data is converted into nonsense using algorithms and can only be read by those holding digital keys, it’s highly unlikely anyone could have accessed all those salacious emails or reported on some of the studio’s more clandestine activities; namely its support for lobbying to have government stop Google hosting links to pirate material and a rather intriguing investigation into “special influence” in China.

Michael Lynton, the CEO of Sony Pictures, whose password was reported to be Sonyml3. Photograph: Danny Moloshok/AP

One lawyer I spoke to said Sony shouldn’t have even been discussing sensitive legal issues over email. Spoken words are ephemeral, written text stored on servers is for life.

Then there’s the virus that has caused Sony so much grief, known as Destover by most. Security experts have noted its simplicity and its crudeness. Its developers made numerous mistakes, meaning the malware was making some noise on the network before it flatlined Sony’s systems.

Could it have been detected with better security? Possibly. The perpetrators had extensive knowledge of the company’s network, but Sony was not able to pick up on any suspicious reconnaissance activity over recent months. It could have taken advantage of technologies that quickly pick up on anomalies as long as they are fed the right data. But, again, leaked emails showed Sony was blind to a lot of traffic on its systems and so it wasn’t able to uncover malicious actions. Translation: it wasn’t protecting itself properly.

The hackers took advantage of these manifold weaknesses and broke in. Now that Sony has pulled the film, irking most of Hollywood’s bigwigs who wanted it to stand up for freedom of speech, the Guardians of Peace has won the fight.

And amid all the histrionics around cyber warfare and terrorism, and the dangerous accusations of North Korean involvement, the privacy of Sony’s workers and ex-employees has been obliterated. Both the hackers and the film giant have to shoulder the blame.