News Corp Journalists Emails Hacked, China Blamed

It’s time to remind ourselves that there is always more information to be discovered after the initial disclosure of a cyber attack like this one. We should expect that the information shared today isn’t the full story.

Cyber attack attribution is extremely difficult, and while the casual reader may draw the conclusion here that China is responsible (which may be true), it’s worth noting the language that Mandiant uses. Mandiant states that “those behind this activity have a China nexus” and that “they are likely involved in espionage activities to collect intelligence to benefit China’s interests.” The statement does not go as far as pointing to the Chinese government directly. The term “China nexus” and the phrase “benefit China’s interests” are both ways of softening the conclusion. In these types of reports, language matters.

On its surface, this seems like the kind of incident the newly formed Cyber Safety Review Board might investigate. This might be a test of the effectiveness of that effort, but given the international nature of News Corp, it will also test how that board addressed the inherently different borders that apply to cybersecurity.

News Corp certainly isn't the first news organisation targeted in an espionage campaign and won't be the last. Other high profile attacks against the New York Times and Associated Press have made headlines in the past and I'd suspect many other news organisations are being targeted on a daily basis. If there is a silver lining with this latest cyberattack, it appears to be that News Corp minimised the data loss.

Normally the Olympic seasons bring out the best in people. Sadly though, threat actors don’t sleep and are waiting to pounce thinking the guard is down on tempting targets. Given the present state of world affairs, all organizations – regardless of industry - should be operating at an increased “state of alert” as the threat environment has expanded greatly due to geopolitical issues.

As the threat environment continues to change, proper and continuous diligence is required to ensure all cyber defensive tools and techniques are employed to protect your most precious data assets. Continuous intelligence, monitoring, and dialogue with critical partners and suppliers should be ongoing to ensure “all is ready” in the event recovery is needed, and that additional support is available in the event something were to occur.