LulzSec claims to have accessed Sony Pictures Entertainment and Sony BMG's servers on Thursday evening, accessing apparently unencrypted data belonging to over one million site users.
The organisation wrote on Twitter: "1,000,000+ unencrypted users, unencrypted admin accounts, government and military passwords [were] saved in plaintext."
It also posted a link to a torrent containing a sample of the compromised data.
LulzSec announced its operation early on Thursday, writing: "Everything we have will be published in multiple ways to ensure maximum embarrassment and exposure for @Sony and their security flaws."
Sony Pictures Entertainment is yet to release a full statement on the breach but a spokesperson told technology blog This Is My Next that the matter is being investigated.
Sony's PlayStation Network was taken offline last month following a breach by hackers who also accessed users' personal information.
LulzSec has also claimed responsibility for hacking the PBS website and posting a news story saying that rapper Tupac Shakur, who was killed in 1996, was actually alive and living in New Zealand.