The Guardian has confirmed it was hit by a ransomware attack in December and that the personal data of UK staff members has been accessed in the incident.
The Guardian Media Group’s chief executive, Anna Bateson, and the Guardian’s editor-in-chief, Katharine Viner, confirmed the news in an update emailed to staff on Wednesday afternoon.
They described the incident as a “highly sophisticated cyber-attack involving unauthorised third-party access to parts of our network”, most likely triggered by a “phishing” attempt in which the victim is tricked, often via email, into downloading malware.
The Guardian said it had no reason to believe the personal data of readers and subscribers had been accessed. It is not believed that the personal data of Guardian US and Guardian Australia staff has been accessed either.
The Information Commissioner’s Office, the UK’s data watchdog, has been informed of the attack, as well as the UK police.
However, the message to staff said there had been no evidence of data being exposed online, so the risk of fraud is considered to be low.
The attack was detected on 20 December and affected parts of the company’s technology infrastructure. Staff, most of whom have been working from home since the attack, have been able to maintain production of a daily newspaper, while online publishing has been unaffected.
“We believe this was a criminal ransomware attack, and not the specific targeting of the Guardian as a media organisation,” said Bateson and Viner.
“These attacks have become more frequent and sophisticated in the past three years, against organisations of all sizes, and kinds, in all countries.”
They added: “We have seen no evidence that any data has been exposed online thus far and we continue to monitor this very closely.”
The Guardian has been using external experts to gauge the extent of the attack and to recover its systems.
Although the Guardian expects some critical systems to be back up and running “within the next two weeks”, a return to office working has been postponed until early February in order to allow IT staff to focus on network and system restoration.
According to a government report last year, two in five UK businesses reported cyber security breaches or attacks in the previous 12 months.
