Cyber Incident Victim: České noviny (ČN)
Date:
Apr 2024
Location:
Czechia
Summary
An attacker compromised the publishing system account of České noviny, operated by Česká tisková kancelář (ČTK), and posted fabricated content falsely claiming Slovakia's BIS agency prevented an assassination attempt on President-elect Peter Pellegrini alongside a forged foreign minister statement. The fabricated articles appeared in Czech and English on the website and triggered mobile app notifications. ČTK confirmed its core news service remained unaffected, removed the content promptly, and blocked unauthorized access. The organization is coordinating with national security agencies and law enforcement regarding the breach. The targeted website publishes approximately 15% of ČTK's full news service content, which remains fully available to clients through other distribution channels.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 23, 2024, an unidentified attacker compromised the publishing system account of České noviny (ČN), a news website operated by the Czech News Agency (ČTK). The intrusion occurred during the morning hours, enabling the perpetrator to publish fabricated content on ČN’s platform. Two fraudulent articles were posted: one falsely claiming Slovakia’s Security Intelligence Service (BIS) had thwarted an assassination attempt against newly elected Slovak President Peter Pellegrini, and another presenting a fictitious emergency statement by Czech Foreign Minister Jan Lipavský regarding the same fabricated event. The attacker published both texts in Czech and English, accompanied by push notifications disseminated through ČN’s mobile application infrastructure. ČTK confirmed these materials did not originate from its editorial processes and were never distributed through its primary news service for media and non-media clients.
ČTK removed the deceptive content from České noviny immediately upon detection and disabled compromised access credentials. The agency confirmed its core news distribution service—including Infobanka ČTK and other client delivery channels—remained unaffected, as the attack exclusively targeted the public-facing ČN website, which publishes approximately 15% of ČTK’s total news output. ČTK initiated coordination with the Security Information Service (BIS), the National Office for Cyber and Information Security (NÚKIB), and law enforcement authorities to investigate the breach. No additional operational details, attacker motivations, or technical specifics about the account compromise were disclosed publicly. The incident temporarily disrupted ČN’s digital publishing operations but did not impact ČTK’s primary revenue-generating news distribution services.