Briefs

Four months later, Cox Media confirms ransomware attack

The Cox Media Group, one of the largest media conglomerates in the US, has formally acknowledged a ransomware attack that crippled and took down live feeds for several TV and radio stations earlier this year, in June.

In breach notification letters filed with US state attorneys’ offices this week, CMG acknowledged the incident for the first time after it previously warned employees not to confirm the intrusion or share details about the attack with the press. The acknowledgment also comes more than four months after the attack took place.

CMG said the incident only impacted “a small percentage of servers” that were encrypted by a ransomware group.

Although the intruders asked for a ransom demand to decrypt affected servers, CMG said they responded by taking the servers offline.

“CMG did not pay a ransom or provide any funds to the threat actor as a result of this incident,” it explained.

The company also said that a recent investigation found that the intruders tried and failed to copy HR-related files from one of the breached servers.

CMG said that even if the attackers didn’t manage to remove the files, the company is now notifying all employees who had data stored in those files after sending an initial set of notifications earlier this year, on July 30.

Personal data stored in the files included the likes of:

  • names
  • addresses
  • Social Security numbers
  • financial account numbers
  • health insurance information
  • health insurance policy numbers
  • medical condition information
  • medical diagnosis information
  • online user credentials

Since the June 3 attack, no ransomware gang has stepped forward to take credit for the Cox Media Group intrusion or to threaten to leak files from the company.

Catalin Cimpanu

Catalin Cimpanu is a cybersecurity reporter for The Record. He previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.

Recent Posts

Metropolitan Opera dealing with cyberattack that shut down website, box office

The Metropolitan Opera confirmed that it is dealing with a crippling cyberattack that has shut…

17 hours ago

South Korean authorities issue warning about disguised North Koreans getting IT jobs

South Korean authorities issued an interagency advisory Thursday warning companies about hiring North Korean IT…

19 hours ago

On hacking forums, even the scammers aren’t safe

Cybercriminals use a range of techniques to steal victims’ money — from developing malicious software…

22 hours ago

Apple unveils new cybersecurity measure for iMessage, iCloud and more

Apple announced several new security features designed to better protect users from an array of…

2 days ago

Iranian hackers accused of targeting diamond industry with wiper malware

Hackers allegedly connected to the Iranian government have been accused of targeting diamond companies in…

2 days ago

Google: North Korean gov’t hackers used Internet Explorer zero-day to target South Korea users

Internet Explorer users in South Korea were targeted by a group of North Korean government…

2 days ago