It does not take much money to tempt a disgruntled insider in IT. A mere $250,000 would do. I am sure North Korea can cough up this type of cash. The "hack" was not really that sophisticated - it was a straight forward administrative privilege theft job leaving standard "IT trojan controls" for hijacking and "IT bombs" in place to take down systems ---- leaving the rest of an IT team struggling to get back-ups back on line while cleaning up widespread infected infrastructure. Any half-smart college comp sci major with a couple of books could have done it.
Don't get me started on the incompetence of the Sony IT staff, governance, and practices.