Cody Kretsinger, 23, is facing charges of conspiracy and the unauthorised impairment of a protected computer in connection with the attack in May and June.
Lulz Secruity, or LulzSec, was able to access names, birth dates, addresses, emails, phone numbers and passwords in the hacking attack of people who had entered contests run by Sony. The group published the data online.
At the time, LulzSec said: "From a single [SQL] injection we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?"
Kretsinger is facing a maximum sentence of 15 years in prison if convicted, and the US government is hoping to transfer him to Los Angeles, where the Sony Pictures IT Systems are based and the case against him has been filed.
The extent of damage caused by the breach of the Sony Pictures computer network remained under investigation, the FBI said.
The attack was a further embarrassment for Sony at the time after hackers accessed personal information on some 77m PlayStation Network and Qriocity accounts, in what was then the biggest such security breach in history.