American media and publishing giant News Corp has disclosed today that it was the target of a “persistent” cyberattack.
About News Corp
The original incarnation of News Corporation (abbreviated News Corp.), also variously known as News Corporation Limited, was an American multinational mass media corporation operated and owned by media mogul Rupert Murdoch and headquartered at 1211 Avenue of the Americas in New York City. Prior to its split in 2013, it was the world’s largest media company in terms of total assets and the world’s fourth largest media group in terms of revenue, and News Corporation had become a media powerhouse since its inception, dominating the news, television, film and print industries. News Corp’s major properties include Fox News, The Wall Street Journal, New York Post, and News UK.
The attack – likely act of Persistent Threat Actors backed by China
The attack discovered sometime this January, reportedly allowed threat actors to access emails and documents of some News Corp employees, including journalists.
News Corp was the target of a hack that accessed emails and documents of journalists and other employees, an incursion the company’s cybersecurity consultant said was likely meant to gather intelligence to benefit China’s interests.
The attack, discovered on Jan. 20, affected a number of publications and business units including The Wall Street Journal and its parent Dow Jones; the New York Post; the company’s U.K. news operation; and News Corp headquarters, according to an email the company sent to staff Friday.
Security firm hired to perform investigations
News Corp said it notified law enforcement and hired cybersecurity firm Mandiant Inc. to support an investigation. A representative of the Federal Bureau of Investigation said late Friday that it was aware of the incident.
“Mandiant assesses that those behind this activity have a China nexus, and we believe they are likely involved in espionage activities to collect intelligence to benefit China’s interests,” said David Wong, vice president of incident response at Mandiant.
The company’s investigation indicates that systems housing financial and customer data, including subscriber information, weren’t affected, according to the securities filing and a person familiar with the matter.
The investigation detected that the intrusion appeared to date to at least February 2020, according to people briefed on the matter, and scores of employees were impacted. The hackers were able to access reporters’ emails and Google Docs, including drafts of articles.
The attackers appeared to be interested in a range of topics, including issues of importance to Beijing such as Taiwan and China’s Uyghur ethnic group, according to other people briefed on the matter and a review of some of the document target lists. Other areas of interest included draft Journal articles and notes about U.S. military troop activity, U.S. technology regulation related to China, and articles about President Joe Biden, Vice President Kamala Harris and senior White House officials.
The hackers also searched using keywords for emails related to traditional intelligence areas, including defense, one person familiar with the ongoing investigation said. Those searches in some cases appeared to be prompted by contemporary news developments. “They would come back periodically,” this person said.
Reactive security controls are too expensive – Insurances is not the answer
While disclosing further risks to its IT infrastructure, News Corp stressed, the cyber risk insurance policy it has in place may not be sufficient “to cover all losses from any breaches” that have occurred or may occur in the future.
“Cyber risk insurance has also become more difficult and expensive to obtain, and the company cannot be certain that its current level of insurance or the breadth of its terms and conditions will continue to be available on economically reasonable terms,” states News Corp in its quarterly filing.
