They keep saying it was “malware” but that typically refers to viruses (that disable parts of a computer/data) or programs that use other peoples’ computers as “zombies/drones/slaves” to do other things elsewhere.
This was data (financial data, communication data, and intellectual property (i.e. FULL movies online)) that was COMPROMISED.
It was hacking more than it was “malware” infection.
E-mail viruses can hand control in multiple layers of systems (application, kernel, etc.) to crackers at specific and repeated times. They can open more ports, set up relays and do all kinds of evil. Some spoke of hints that some North Koreans are behind it.
Malware and viruses are not the same. Viruses are intended to be very difficult to remove and tend to be destructive of their hosts. Malware is intended to be difficult to detect and provides vectors for attack through known open ports on a machine.
What happened to Sony started off by someone opening an email attachment or being redirected to a malware-laden website. Once the infection was established, it starts to scan its network for other vulnerable machines. For instance, one of the big vectors for infection now are XP machines due to their lack of patching and relative ubiquity in some workplaces for legacy applications. If those XP machines are connected to a non-sequestered VLAN or otherwise permitted full access to the Internet, they become prime candidates for trojan horses.
Fact is that viruses are becoming less popular. Almost everyone makes some sort of virus scanning and heuristics engine to spot the telltale signs of a virus. To circumvent that, malware is now a voluntarily-installed piece of software that purports to be a necessary plugin for a website or otherwise takes advantage of a user’s ignorance. Once the malware is established, it spreads quickly because virus scanners are not searching for malware, they’re searching for viruses. Malware is being used everywhere for espionage and acts as the raft upon which the bad guys float into most organization’s well-guarded systems.