Four months later, Cox Media confirms ransomware attack

The Cox Media Group, one of the largest media conglomerates in the US, has formally acknowledged a ransomware attack that crippled and took down live feeds for several TV and radio stations earlier this year, in June.

In breach notification letters filed with US state attorneys' offices this week, CMG acknowledged the incident for the first time after it previously warned employees not to confirm the intrusion or share details about the attack with the press. The acknowledgment also comes more than four months after the attack took place.

CMG said the incident only impacted "a small percentage of servers" that were encrypted by a ransomware group.

Although the intruders asked for a ransom demand to decrypt affected servers, CMG said they responded by taking the servers offline.

"CMG did not pay a ransom or provide any funds to the threat actor as a result of this incident," it explained.

The company also said that a recent investigation found that the intruders tried and failed to copy HR-related files from one of the breached servers.

CMG said that even if the attackers didn't manage to remove the files, the company is now notifying all employees who had data stored in those files after sending an initial set of notifications earlier this year, on July 30.

Personal data stored in the files included the likes of:

• names
• addresses
• Social Security numbers
• financial account numbers
• health insurance information
• health insurance policy numbers
• medical condition information
• medical diagnosis information
• online user credentials

Since the June 3 attack, no ransomware gang has stepped forward to take credit for the Cox Media Group intrusion or to threaten to leak files from the company.