Cyber Incident Victim: Nine Network
Date:
Mar 2021
Location:
Australia
Summary
A cyber attack disrupted live broadcasts for a major Australian broadcaster, preventing multiple news programs from airing and impacting nationwide operations. The incident primarily affected broadcast and corporate IT systems, though email remained functional; internal teams worked to partially restore programming by evening, with full recovery expected the following day while staff operated remotely. The company described the event as a malicious ransomware attack, though no responsible party claimed credit for the intrusion.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 28, 2021, Australian broadcaster Channel Nine experienced a significant cyber attack that disrupted its live television broadcasts nationwide. The incident prevented the airing of the Sunday morning news program from its Sydney studio between 7:00 am and 1:00 pm local time, followed by the failure of the 5:00 pm news broadcast from Melbourne. Channel Nine management confirmed via staff email that a cyber attack had targeted their systems, primarily affecting broadcast operations and corporate business units while leaving email systems operational. Internal IT teams immediately initiated around-the-clock efforts to restore compromised systems. By 6:00 pm, technicians successfully resumed partial operations, allowing the Melbourne studio to broadcast its evening news program normally while recovery work continued on other affected segments.
The broadcaster described the incident as an unprecedented malicious attack, with anonymous internal sources suggesting ransomware as the primary vector. Nine News Melbourne presenter Alicia Loxley publicly confirmed the network had suffered a "massive ransomware attack" that crippled systems across Australia, though no threat actor claimed responsibility. Management anticipated full restoration of programming by Monday morning but warned staff that operational impacts might extend beyond Sunday. As a precautionary measure, Channel Nine instructed employees to work from home during the recovery process. The attack also affected sister publication The Australian Financial Review, which reported on the incident while experiencing related disruptions to its own operations under Nine's corporate umbrella.